CLSA-2026-1768349319 TuxCare security update for org.springframework.security (4 CVEs)

TuxCare rebuilt 19 org.springframework.security packages to address 4 CVEs. Fixed in 6.1.6-tuxcare.1...

CLSA-2024-1727308812 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.11.tuxcare...

CLSA-2025-1742947247 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.8.16.tuxcare...

K000162757: Spring Security vulnerability CVE-2026-47838

Security Advisory Description SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected...

PT-2026-73704

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.1.4-tuxcare.1...

ROOT-APP-MAVEN-CVE-2024-38827 CVE-2024-38827 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2024-38827 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2023-20862 CVE-2023-20862 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2023-20862 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

BASM (Broken Authentication & Session Management) org.springframework.security:spring-security-web Dependency in Crowd Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 6.0.0, 6.1.0, 6.2.0, 6.3.0, 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

CVE-2026-59328

creationtimestamp| type| source ---|---|--- 2026-07-30 16:15:15+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-759...

CVE-2026-59327

creationtimestamp| type| source ---|---|--- 2026-07-30 16:15:13+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-759...

CVE-2026-8338

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoint...

CVE-2026-8338

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoint...

CVE-2026-8338

The CVE describes a Spring Security authentication and authorization bypass in Coverity Connect versions 2023.6.0–2026.3.0. An unauthenticated attacker can send a specially crafted HTTP request to bypass authentication/authorization on certain API endpoints and access data within Coverity. CVSS 4...

EUVD-2026-50413

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoint...

ROOT-APP-MAVEN-CVE-2026-47838 CVE-2026-47838 in io.root.org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2026-47838 in the io.root.org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22751 CVE-2026-22751 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2026-22751 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22748 CVE-2026-22748 in io.root.org.springframework.security:spring-security-oauth2-jose - Patched by Root

Root has patched CVE-2026-22748 in the io.root.org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-22234 CVE-2024-22234 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2024-22234 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-22258 CVE-2024-22258 in io.root.org.springframework.security:spring-security-oauth2-authorization-server - Patched by Root

Root has patched CVE-2024-22258 in the io.root.org.springframework.security:spring-security-oauth2-authorization-server package for Root:Maven. Multiple fixed versions available...

PT-2026-65859

Name of the Vulnerable Software and Affected Versions Coverity Connect versions 2023.6.0 through 2026.3.0 Description An authentication and authorization bypass exists due to a flaw in Spring Security. An unauthenticated attacker can send a specially crafted HTTP request to bypass security contro...