1389 matches found
Replay Attack
Overview org.springframework.security:spring-security-oauth2-jose is a provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Replay Attack through the DPoPProofJwtDecoderFactory. An attacker can gain unauthorized access and impersonate a victim...
Binding to an Unrestricted IP Address
Overview org.springframework.security:spring-security-ldap is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Binding to an...
cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification
cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification...
cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces...
Timing Attack
Overview org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Timing Attack via the comparison of sensitive values using standard string equality rather than constant-time...
Access Control Bypass
Overview org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Access Control Bypass in the InetAddressMatchers process. An attacker can bypass network-based access control...
Improper Verification Of Cryptographic Signature
Spring Security is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to SAML Responses and LogoutRequest/LogoutResponse elements being decrypted without requiring a valid signature, which allows an attacker to craft malicious SAML payloads and use the Servic...
K000162929: Spring Security Authorization Server vulnerability CVE-2026-41008
Security Advisory Description Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can...
Open Redirect
Spring Security is vulnerable to Open Redirect. The vulnerability is due to CookieRequestCache and CookieServerRequestCache storing and using an unvalidated absolute URL from a browser cookie as the post-login redirect target, allowing an attacker to redirect users to a malicious destination...
Deserialization Of Untrusted Data
Spring Security is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to malicious serialized payloads being stored in verificationcredentials or encryptioncredentials by an attacker with write access to the saml2assertingpartymetadata table managed by...
Denial Of Service
Spring Security is vulnerable to Denial Of Service. The vulnerability is due to an unbounded writer inflating compressed SAML payloads into memory when processing SAML 2.0 Login or Logout requests using the REDIRECT binding, allowing an attacker to exhaust application memory...
Cross Site Scripting
Spring Security is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to attacker-controlled values in RelyingPartyRegistration being rendered in HTML forms generated by Spring Security filters, allowing arbitrary code execution in the context of the application...
CLSA-2026-1786563390 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 19 org.springframework.security packages to address 1 CVE. Fixed in 6.2.7-tuxcare.3...
K000162895: Spring Framework CookieRequestCache vulnerability CVE-2026-41706
Security Advisory Description Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is...
CLSA-2026-1786479067 TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 21 org.springframework.security packages to address 4 CVEs. Fixed in 5.6.10-tuxcare.7...
CLSA-2026-1785965552 TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 21 org.springframework.security packages to address 4 CVEs. Fixed in 5.7.14-tuxcare.4...
Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.
Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in July 2026. Vulnerability Details CVEID:CVE-2026-40984 DESCRIPTION: In Micrometer, it is possible for a user to provid...
CLSA-2026-1785814692 TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 18 org.springframework.security packages to address 3 CVEs. Fixed in 6.0.8-tuxcare.1...