CVE-2026-8338

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoint...

ROOT-APP-MAVEN-CVE-2026-22748 CVE-2026-22748 in io.root.org.springframework.security:spring-security-oauth2-jose - Patched by Root

Root has patched CVE-2026-22748 in the io.root.org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-47838 CVE-2026-47838 in io.root.org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2026-47838 in the io.root.org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22751 CVE-2026-22751 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2026-22751 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38821 CVE-2024-38821 in io.root.org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2024-38821 in the io.root.org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-22234 CVE-2024-22234 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2024-22234 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-22258 CVE-2024-22258 in io.root.org.springframework.security:spring-security-oauth2-authorization-server - Patched by Root

Root has patched CVE-2024-22258 in the io.root.org.springframework.security:spring-security-oauth2-authorization-server package for Root:Maven. Multiple fixed versions available...

PT-2026-65859

Name of the Vulnerable Software and Affected Versions Coverity Connect versions 2023.6.0 through 2026.3.0 Description An authentication and authorization bypass exists due to a flaw in Spring Security. An unauthenticated attacker can send a specially crafted HTTP request to bypass security contro...

Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-security-core jar (CVE-2026-40988, CVE-2026-41694)

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-40988 and CVE-2026-41694 reported for spring-security-core-6.4.12.jar, spring-security-core-6.5.10.jar. Vulnerability Details CVEID:CVE-2026-40988 DESCRIPTION: An application using...

Security Bulletin: Security Vulnerability in Spring-Security affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-22732)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Spring-Security Vulnerability Details CVEID:CVE-2026-22732 DESCRIPTION: When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility th...

Vulnerabilities found in Oracle Financial Services

Oracle has identified vulnerabilities in various Financial Services modules. Oracle has also processed updates for various third-party products. The vulnerabilities include code injection through malicious schemes in Apache Avro, unauthorized access to sensitive data in various Oracle products, a...

K000162315: Multiple Spring framework vulnerabilities

Security Advisory Description CVE-2026-41708 In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service DoS condition. The application is vulnerable when it uses a vulnerable version of...

EUVD-2026-44904

Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10...

BASM (Broken Authentication & Session Management) org.springframework.security:spring-security-web Dependency in Jira Software Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This BASM Broken Authentication & Session Management vulnerability,...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.4.20 Vulnerability Details CVEID:CVE-2026-41003 DESCRIPTION: An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.2.28 Vulnerability Details CVEID:CVE-2026-41003 DESCRIPTION: An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 2.7.40 Vulnerability Details CVEID:CVE-2026-41003 DESCRIPTION: An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilites

Summary The vulnerabilities were found in dependent open source libraries used within IBM Quantum Safe Explorer code base. These issues have been addressed by updating the versions of affected libraries. Vulnerability Details CVEID:CVE-2026-9595 DESCRIPTION: Impact: When a user-configured proxy o...

Security Bulletin: IBM Terracotta is affected by a Spring Security vulnerability that could allow Redirection to Untrusted Sites and Denial of Service (Dos) attacks

Summary IBM Terracotta uses Spring Security as an application security framework within the product. Vulnerability Details CVEID:CVE-2026-40988 DESCRIPTION: An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a...

Security Bulletin: IBM Terracotta is affected by a Spring Security vulnerability that could allow Redirection to Untrusted Sites

Summary IBM Terracotta uses Spring Security as an application security framework within the product. CVE-2026-41706 Vulnerability Details CVEID:CVE-2026-41706 DESCRIPTION: Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cooki...