PT-2026-82692

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 Spring...

CVE-2026-47883: URL Redirection to Untrusted Site

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

PT-2026-82408

Name of the Vulnerable Software and Affected Versions Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 7.0.0 through 7.0.8 Description Spring MVC and WebFlux applications are susceptible to stream corruption. This issue occurs specifically when utilizing Server-Sent Events...

CVE-2026-47884: Improper Limitation of a Pathname to a Restricted Directory

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

PT-2026-82401

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Description UrlHandlerFilter in both Spring MVC and Spring WebFlux is susceptible to an open redirect when configured with very broadly matching...

Security Bulletin: Vulnerability in Spring MVC and WebFlux affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Spring MVC and WebFlux has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional...

CVE-2014-0225

CVE-2014-0225...

CVE-2026-41846

CVE-2026-41846...

CVE-2026-59989

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through SpringTemplateLoader.getResource and resolve in the Spring MVC template-loading path. An attacker can read local files by supplying a file: or classpath: view name with a fragment suffix, which causes the...

CVE-2026-59989: Improper Control of Generation of Code

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

CVE-2026-63490

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-bas...

CVE-2026-63490 Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-bas...

CVE-2026-63490

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-bas...

CVE-2026-63490 Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-bas...

CVE-2026-63490

CVE-2026-63490 is an arbitrary file read vulnerability in the handlebars-springmvc module of Handlebars.java (prior to 4.5.3). The SpringTemplateLoader resolves Spring MVC view names via Spring's ResourceLoader without path-containment validation. An attacker can craft a view name using a file: o...

CVE-2026-63490: Improper Limitation of a Pathname to a Restricted Directory

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-bas...

Open Redirect

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Open Redirect in the...

Security Bulletin: Multiple Vulnerabilities in watsonx.data

Summary Multiple vulnerabilities were addressed in watsonx.data 2.3.1 patch 6 version, which was present in different version from watson.data 2.3.1 to watsonx.dat 2.3.1 Patch 5 Vulnerability Details CVEID:CVE-2026-22741 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to cache...

Security Bulletin:Vulnerability in Spring MVC and WebFlux affects IBM Netezza Appliance

Summary The Spring MVC and WebFlux packages are used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-41853 Vulnerability Details CVEID:CVE-2026-41853 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks...