Vmware Spring Security vulnerabilities

• spring security, vmware spring security +1 more Spring Security InetAddressMatchers Incomplete Internal Network Classification CVE-2026-59277 3.7 LowAugust 27, 2026
• spring security, vmware spring security +1 more Timing Attack via Non-Constant-Time Comparison of Sensitive Values CVE-2026-59276 Fix available 5.9 MediumAugust 27, 2026
• vmware spring security, vmware by broadcom spring security (oauth2 authorization server module) +1 more Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata CVE-2026-59354 9.6 CriticalAugust 27, 2026
• spring security, vmware spring security +1 more Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces CVE-2026-59270 Fix available 9.4 CriticalAugust 27, 2026
• spring security, vmware spring security +1 more Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) CVE-2026-47877 8.2 HighAugust 27, 2026
• spring security, vmware spring security +1 more Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation CVE-2026-47842 Fix available 6.5 MediumAugust 26, 2026
• spring security, vmware spring security +1 more WebAuthn User Verification Bypass via Session Serialization CVE-2026-47841 Fix available 7.4 HighAugust 26, 2026
• spring security, vmware spring security +1 more Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay CVE-2026-41707 Fix available 7.4 HighAugust 25, 2026
• spring security, vmware spring security +1 more Unauthorized User Impersonation when Using X.509 Client Certificates CVE-2026-47838 Fix available 6.8 MediumJune 9, 2026
• spring security, vmware spring security +1 more Open Redirect When Using CookieRequestCache CVE-2026-41706 Fix available 6.1 MediumJune 9, 2026
• spring security, vmware spring security +1 more SAML Payloads Decrypted Without Valid Signature CVE-2026-41694 Fix available 3.7 LowJune 9, 2026
• broadcom spring authorization server, spring authorization server, security +1 more +3 more Spring Security Authorization Server Open Redirect via request_uri CVE-2026-41008 Fix available 6.1 MediumJune 9, 2026
• spring security, vmware spring security +1 more Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting CVE-2026-41003 Fix available 7.6 HighJune 9, 2026
• spring security, vmware spring security +1 more Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry CVE-2026-40993 Fix available 7.3 HighJune 9, 2026
• spring security, vmware spring security +1 more Unbounded DEFLATE Inflation in SAML 2.0 Service Provider CVE-2026-40988 Fix available 7.5 HighJune 9, 2026
• spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 more ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules CVE-2026-22754 Fix available 7.5 HighApril 22, 2026
• spring security, vmware spring security +1 more Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers CVE-2026-22753 Fix available 7.5 HighApril 22, 2026
• spring security, vmware spring security +1 more Potential Security Misconfiguration when Using withIssuerLocation CVE-2026-22748 Fix available 5.3 MediumApril 22, 2026
• spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 more Unauthorized User Impersonation when Using X.509 Client Certificates CVE-2026-22747 Public exploitFix available 6.8 MediumApril 22, 2026
• spring security, vmware spring security +1 more User Attribute Enumeration when Using DaoAuthenticationProvider CVE-2026-22746 Fix available 3.7 LowApril 22, 2026
• spring security, vmware spring security +1 more Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions CVE-2026-22751 Fix available 4.8 MediumApril 21, 2026
• spring security, vmware spring security +1 more Under Some Conditions Spring Security HTTP Headers Are not Written CVE-2026-22732 Public exploitFix available 9.1 CriticalMarch 19, 2026
• spring security, vmware spring security +1 more Missing Authorization When Using @AuthorizeReturnObject CVE-2024-38810 Fix available 6.5 MediumAugust 20, 2024
• spring security, vmware spring security +1 more CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated CVE-2024-22234 Fix available 7.4 HighFebruary 20, 2024
• spring security, vmware spring security +1 more Spring Security's spring-security.xsd file is world writable CVE-2023-34042 Fix available 4.1 MediumFebruary 5, 2024
• spring security, vmware spring security +1 more Access Control Bypass in Spring Security CVE-2023-34034 Public exploitFix available 9.1 CriticalJuly 19, 2023
• spring security, vmware spring security +1 more Spring Security's authorization rules can be misconfigured when using multiple servlets CVE-2023-34035 Public exploitFix available 7.3 HighJuly 18, 2023
• spring security, vmware spring security, netapp active iq unified manager +2 more Spring Security logout not clearing security context CVE-2023-20862 Fix available 6.3 MediumApril 19, 2023
• vmware spring security, netapp active iq unified manager +1 more Spring Security authorization rules can be bypassed via forward or include dispatcher types CVE-2022-31692 Public exploitFix available 9.8 CriticalOctober 31, 2022
• spring security, vmware spring security, netapp active iq unified manager +2 more spring-security-oauth2-client vulnerable to Privilege Escalation CVE-2022-31690 Fix available 8.1 HighOctober 31, 2022
• spring security, vmware spring security, netapp active iq unified manager +1 more +3 more Integer overflow in BCrypt class in Spring Security CVE-2022-22976 Public exploitFix available 5.3 MediumMay 19, 2022
• spring security, vmware spring security, netapp active iq unified manager +1 more +3 more Authorization bypass in Spring Security CVE-2022-22978 Public exploitFix available EPSS 12.4% 9.8 CriticalMay 19, 2022
• spring security, vmware spring security, oracle communications cloud native core policy +2 more Resource Exhaustion in Spring Security CVE-2021-22119 Public exploitFix available 7.5 HighJune 29, 2021
• pivotal software spring security, spring security, oracle communications element manager +5 more +7 more Privilege escalation in spring security CVE-2021-22112 Fix available 8.8 HighFebruary 23, 2021
• pivotal software spring security, spring security +1 more Dictionary attack with Spring Security queryable text encryptor CVE-2020-5408 Fix available 6.5 MediumMay 14, 2020
• spring security, vmware spring security, debian linux +2 more PlaintextPasswordEncoder authenticates encoded passwords that are null CVE-2019-11272 Fix available 7.3 HighJune 26, 2019
• spring security, vmware spring security, debian linux +2 more Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security CVE-2019-3795 Fix available 3.8 LowApril 9, 2019
• vmware spring framework, spring security, dell emc spring by pivotal +3 more +5 more Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core CVE-2018-1199 Fix available 5.3 MediumMarch 16, 2018
• vmware spring security Deserialization of Untrusted Data in Spring Security CVE-2017-4995 Fix available 8.1 HighNovember 27, 2017
• pivotal spring framework, spring security, spring security +2 more Spring Security and Spring Framework may not recognize certain paths that should be protected CVE-2016-5007 Fix available 7.5 HighMay 25, 2017
• pivotal spring security, spring security +1 more Authorization Bypass in Spring Security CVE-2014-3527 Fix available 9.8 CriticalMay 25, 2017
• pivotal spring security, spring security +1 more Improper Authentication in Spring Security CVE-2014-0097 Fix available 7.3 HighMay 25, 2017
• ibm websphere application server, vmware spring security +1 more Security Constraint Bypass in Spring Security CVE-2016-9879 Fix available 7.5 HighJanuary 6, 2017
• vmware springsource spring security Exposure of Sensitive Information to an Unauthorized Actor in Spring Security CVE-2012-5055 Fix available 5.0 MediumDecember 5, 2012
• vmware springsource spring security Improper Control of Generation of Code in Spring Security CVE-2011-2732 Public exploitFix available 4.3 MediumDecember 5, 2012
• vmware springsource spring security Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security CVE-2011-2731 Fix available 5.1 MediumDecember 5, 2012
• vmware spring framework, spring security +1 more Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data CVE-2011-2894 Public exploitFix available 6.8 MediumOctober 4, 2011
• ibm websphere application server, vmware springsource spring security, acegisecurity acegi-security +2 more Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security CVE-2010-3700 Fix available 5.0 MediumOctober 29, 2010