CVE-2026-59321

Spring Integration versions 7.1.0 , 7.0.0–7.0.5 , 6.5.0–6.5.10 , 6.4.0–6.4.12 , and 5.5.21 and earlier are affected by a thread-safety flaw in script-backed channels. A single JSR-223 ScriptEngine instance is shared across all messages without verifying the engine's THREADING capability. When a n...

CVE-2026-59321 Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

CVE-2026-59321

CVE-2026-59321...

CVE-2021-21307

CVE-2021-21307 : Lucee Admin has an unauthenticated remote code execution vulnerability in Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. The issue is fixed in those versions; a workaround is to block access to the Lucee Administrator. Public exploitation templates (e.g., an unordere...