2779 matches found
Open Redirect
Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...
cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse...
cve-2026-47893 - LOW - Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService
cve-2026-47893 - LOW - Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService...
cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader
cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader...
cve-2026-47864 - MEDIUM - Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
cve-2026-47864 - MEDIUM - Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution...
cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler...
cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder...
cve-2026-47890 - LOW - Spring Framework Server Sent Event stream corruption while rendering fragments
cve-2026-47890 - LOW - Spring Framework Server Sent Event stream corruption while rendering fragments...
cve-2026-47887 - MEDIUM - Spring Framework Open Redirect in UrlFileNameViewController
cve-2026-47887 - MEDIUM - Spring Framework Open Redirect in UrlFileNameViewController...
Cross-site Scripting (XSS)
Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...
Vulnerabilities found in Oracle Financial Services
Oracle has identified vulnerabilities in various Financial Services Enterprise modules. These vulnerabilities exist in third-party products such as Apache Kafka, Log4j, and the Spring Framework. Updates have been released by the developers for these products. These updates are now integrated into...
CLSA-2026-1787070801 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 6 CVEs. Fixed in 5.1.20.RELEASE-tuxcare.4...
CLSA-2026-1787057569 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.2.15-tuxcare.5...
CLSA-2026-1787031282 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.1.16-tuxcare.1...
CVE-2026-67920
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir, and org.springframework.util.FileSystemUtils.copyRecursively components...
CLSA-2026-1786717612 TuxCare security update for org.springframework (7 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 7 CVEs. Fixed in 6.0.23-tuxcare.5...
Deserialization Of Untrusted Data
Spring Framework is vulnerable to deserialization of untrusted data. The vulnerability is due to MappingJackson2MessageConverter and JacksonJsonMessageConverter allowing arbitrary class instantiation from untrusted JMS messages, which allows an attacker to exploit gadget classes during...
Denial Of Service
Spring Data Commons is vulnerable to Denial Of Service. The vulnerability is due to a StackOverflowException when parsing attacker-controlled Sort parameters, allowing an attacker to exhaust application resources...
