14903 matches found
EUVD-2026-25937
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack...
CVE-2026-40973
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack...
CVE-2026-40973
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack...
CVE-2026-40973
A local attacker on the same host as the application may be able to take control of the directory used by "ApplicationTemp". When "server.servlet.session.persistent" is set to "true" and the attack persists across application restarts, this may allow the attacker to read session information and...
CVE-2026-40971
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14 per vendor advisory...
EUVD-2026-25936
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...
com.jayxu:demo (>=0.10.0, <=0.11.0), com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example (>=3.0.9, <=3.1.0) +9 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=4.0.1, <=4.0.3)
org.springframework.boot:spring-boot-devtools MAVEN version =4.0.1, =0.10.0, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =4.0.0, =2.0.0, =2.1.1 - de.tschuehly:spring-view-component-thymeleaf 0.9.1 - io.stereov.singularity:core 1.10.6 - org.flowable:flowable-app-rest 8.0.0 - se.swedenconnect.bankid:bankid-idp...
br.com.m4rc310:br-com-m4rc310-gql (>=1.0.42, <=1.0.45), br.com.m4rc310:br-com-m4rc310-gtim (>=1.0.42, <=1.0.45) +33 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.3.0, <=3.3.7)
org.springframework.boot:spring-boot-devtools MAVEN version =3.3.0, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =4.0.0, =4.0.0, =1.6.0, =1.0.7, =1.0.8 and more Source cves: CVE-2026-40972 Source advisory: MEND:CVE-2026-40972...
CVE-2026-40972
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...
CVE-2026-40972
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...
CVE-2026-40972
The CVE-2026-40972 involves a Timing Attack on the DevTools remote secret comparison in Spring Boot. An attacker on the same network can measure timing differences when the remote secret is compared, enabling character-by-character deduction of the secret. In extreme cases this could allow upload...
CVE-2026-40972
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...
com.digitalsanctuary:ds-spring-user-framework (>=3.2.3, <=3.3.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=4.1.0, <=4.1.1) +42 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.5.0, <=3.5.11)
org.springframework.boot:spring-boot-devtools MAVEN version =3.5.0, =3.2.3, =4.1.0, =3.0.2g, =3.2.2, =1.1.1, =1.2.0 - de.tschuehly:spring-view-component-thymeleaf 0.9.0 - io.gitee.javakiller:wxz-common 2026.08.30-jdk17 - io.gitee.javakiller:wxz-common-web 2026.08.30-jdk17 -...
br.com.m4rc310:br-com-m4rc310-graphql (1.0.1), br.com.m4rc310:br-com-m4rc310-libs (1.0.1) +75 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=2.7.0, <=2.7.18)
org.springframework.boot:spring-boot-devtools MAVEN version =2.7.0, =1.0.2, =1.0.2, =1.0.101, =0.5.0, =3.0.1, =3.0.1, =2.1.6, =2.1.6, =2.1.6, =2.1.6, =2.1.7 and more Source cves: CVE-2026-40972 Source advisory: MEND:CVE-2026-40972...
br.com.m4rc310:br-com-m4rc310-core-graphql (>=1.0.2, <=1.0.18), br.com.m4rc310:br-com-m4rc310-core-gtim (>=1.0.4, <=1.0.18) +41 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.4.0, <=3.4.13)
org.springframework.boot:spring-boot-devtools MAVEN version =3.4.0, =1.0.2, =1.0.4, =1.0.2, =1.0.16, =1.0.2, =1.0.4, =3.0.0, =2.3.0, =2.3.0, =2.2, =3.1.9, =0.5.5, =0.5.0, =0.5.3, =0.7.0 and more Source cves: CVE-2026-40972 Source advisory: MEND:CVE-2026-40972...
CVE-2026-40972
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...
CVE-2026-40971
Spring Boot RabbitMQ auto-configuration fails to verify hostnames when SSL bundles are enabled. Affected: Spring Boot 4.0.0–4.0.5 and 3.5.0–3.5.13. Root cause: hostname verification is not performed during broker connection, enabling potential interception or tampering on networks. Mitigation: pa...
CVE-2026-40971
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14 per vendor advisory...
ai.platon.pulsar:pulsar-agentic (>=4.5.0, <=4.6.0), ai.platon.pulsar:pulsar-boot (>=4.5.0, <=4.9.5) +5305 more potentially affected by CVE-2026-40971 via org.springframework.boot:spring-boot-autoconfigure (>=4.0.0, <=4.0.5)
org.springframework.boot:spring-boot-autoconfigure MAVEN version =4.0.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-2, =2.0.0-beta-1, =2.0.0-beta-1, =2.0.0 and more Source cves: CVE-2026-40971 Source advisory: MEND:CVE-2026-40971...
CVE-2026-40971
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14 per vendor advisory...