cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces...

Improper Verification Of Cryptographic Signature

Spring Security is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to SAML Responses and LogoutRequest/LogoutResponse elements being decrypted without requiring a valid signature, which allows an attacker to craft malicious SAML payloads and use the Servic...

Open Redirect

Spring Security is vulnerable to Open Redirect. The vulnerability is due to CookieRequestCache and CookieServerRequestCache storing and using an unvalidated absolute URL from a browser cookie as the post-login redirect target, allowing an attacker to redirect users to a malicious destination...

Deserialization Of Untrusted Data

Spring Security is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to malicious serialized payloads being stored in verificationcredentials or encryptioncredentials by an attacker with write access to the saml2assertingpartymetadata table managed by...

K000162895: Spring Framework CookieRequestCache vulnerability CVE-2026-41706

Security Advisory Description Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is...

CLSA-2026-1786479067 TuxCare security update for org.springframework.security (4 CVEs)

TuxCare rebuilt 21 org.springframework.security packages to address 4 CVEs. Fixed in 5.6.10-tuxcare.7...

CLSA-2026-1785965552 TuxCare security update for org.springframework.security (4 CVEs)

TuxCare rebuilt 21 org.springframework.security packages to address 4 CVEs. Fixed in 5.7.14-tuxcare.4...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in July 2026. Vulnerability Details CVEID:CVE-2026-40984 DESCRIPTION: In Micrometer, it is possible for a user to provid...

CLSA-2026-1773015254 TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 15 org.springframework.security packages to address 5 CVEs. Fixed in 4.2.20.RELEASE-tuxcare.1...

ROOT-APP-MAVEN-CVE-2023-20862 CVE-2023-20862 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2023-20862 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-22257 CVE-2024-22257 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2024-22257 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-31692 CVE-2022-31692 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2022-31692 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38827 CVE-2024-38827 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2024-38827 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

CVE-2026-59328

creationtimestamp| type| source ---|---|--- 2026-07-30 16:15:15+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-759...

CVE-2026-59327

creationtimestamp| type| source ---|---|--- 2026-07-30 16:15:13+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-759...

CVE-2026-8338

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoint...

CVE-2026-8338

The CVE describes a Spring Security authentication and authorization bypass in Coverity Connect versions 2023.6.0–2026.3.0. An unauthenticated attacker can send a specially crafted HTTP request to bypass authentication/authorization on certain API endpoints and access data within Coverity. CVSS 4...

ROOT-APP-MAVEN-CVE-2026-22748 CVE-2026-22748 in io.root.org.springframework.security:spring-security-oauth2-jose - Patched by Root

Root has patched CVE-2026-22748 in the io.root.org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22751 CVE-2026-22751 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2026-22751 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22732 CVE-2026-22732 in io.root.org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2026-22732 in the io.root.org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...