CVE-2026-47887 Spring Framework Open Redirect in UrlFileNameViewController

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30...

CVE-2026-47887

CVE-2026-47887 is an open redirect in Spring Framework's UrlFileNameViewController when it is mapped with an end-of-path and no configured prefix is set. The vulnerability affects Spring Framework 7.0.0–7.0.8 , 6.2.0–6.2.19 , 6.1.0–6.1.28 , 6.0.0–6.0.30 , 5.3.0–5.3.49 , and 5.2.25.RELEASE and ear...

CVE-2026-47884

Spring Framework 's XsltView in Spring MVC is vulnerable to SSRF and RCE when an application uses a /** mapping that triggers view rendering without explicitly specifying the view name. This improper path limitation allows an attacker to manipulate view resolution to execute arbitrary code or mak...

CVE-2026-47884 Spring Framework Improper Path Limitation in XsltView

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

CVE-2026-47894 Spring Cloud Config Server Native Environment Repository Exposure

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...

EUVD-2026-66845

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...

CVE-2026-47894

Spring Cloud Config Server is vulnerable to directory traversal via its native environment repository, allowing an attacker to access sensitive configuration files outside the intended repository path by sending crafted requests. The affected versions span multiple release lines: 5.0.0–5.0.4, 4.3...

CVE-2026-81491

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingestnotes/teleportnotes/syncnotes/projectfolder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publishe...

EUVD-2026-66827

An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...

EUVD-2026-66822

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

CVE-2026-81485

A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file src/tools/campaign-management.ts of the component Media Upload. Such manipulation of the argument filePath leads to path traversal. The...

CVE-2026-81486

A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function readcontext of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack...

CVE-2026-81491 boxpositron with-context-mcp index.ts project_folder path traversal

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingestnotes/teleportnotes/syncnotes/projectfolder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publishe...

CVE-2026-81491

A path traversal vulnerability exists in boxpositron with-context-mcp up to version 3.0.7 , affecting the functions ingest_notes, teleport_notes, sync_notes, and project_folder within src/index.ts. The flaw can be exploited remotely with no required privileges or user interaction, leading to part...

EUVD-2026-66835

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingestnotes/teleportnotes/syncnotes/projectfolder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publishe...

CVE-2026-81491 boxpositron with-context-mcp index.ts project_folder path traversal

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingestnotes/teleportnotes/syncnotes/projectfolder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publishe...

CVE-2026-81486 bsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal

A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function readcontext of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack...

EUVD-2026-66833

A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function readcontext of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack...

CVE-2026-81486

bsmi021 mcp-file-context-server 1.0.0 contains a path traversal vulnerability in the Path Resolution component, specifically in the function read_context within src/index.ts. Manipulating the path argument allows an unauthenticated remote attacker to read files outside the intended directory, res...

CVE-2026-47862

An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...