2878 matches found
CVE-2022-22978
CVE-2022-22978: Spring Security Authorization Bypass Summary Spring Security framework is a security framework that provides authentication and authorization functions in Spring-based applications. In Spring Security versions 5.5.6, 5.6.3 and earlier, when using RegexRequestMatcher, a function th...
cve-2022-31692
CVE-2022-31692 A demonstration of a Spring Security authorization bypass. See CVE-2022-31692 Spring Security Authorization bypass on Don't Panic!...
CLEANSTART-2026-YJ38996 When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written
Security vulnerability affects the thingsboard package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...
SpringSource__spring-security-oauth_CVE-2018-1260_2-3-2-RELEASE
This project provides support for using Spring Security with OAuth 1a and OAuth2. It provides features for implementing both consumers and providers of these protocols using standard Spring and Spring Security programming models and configuration idioms. Code of Conduct This project adheres to th...
CVE-2025-4427-CVE-2025-4428
CVE-2025-4428 & CVE-2025-4427 CVE-2025-4428 is a post-auth remote code execution vulnerability in EPMM's DeviceFeatureUsageReportQueryRequestValidator. It arises from the unsafe handling of user-supplied input within error messages processed via Spring’s AbstractMessageSource, which allows...
org.keycloak:keycloak-adapter-core (22.0.0), org.keycloak:keycloak-jakarta-servlet-filter-adapter (22.0.0) +4 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (22.0.0)
org.keycloak:keycloak-policy-enforcer MAVEN version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - org.keycloak:keycloak-adapter-core 22.0.0 -...
org.keycloak:keycloak-adapter-core (22.0.2), org.keycloak:keycloak-jakarta-servlet-filter-adapter (22.0.2) +4 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (22.0.2)
org.keycloak:keycloak-policy-enforcer MAVEN version 22.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - org.keycloak:keycloak-adapter-core 22.0.2 -...
org.keycloak:keycloak-adapter-core (24.0.1), org.keycloak:keycloak-jakarta-servlet-filter-adapter (24.0.1) +4 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (24.0.1)
org.keycloak:keycloak-policy-enforcer MAVEN version 24.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - org.keycloak:keycloak-adapter-core 24.0.1 -...
org.keycloak:keycloak-adapter-core (24.0.2), org.keycloak:keycloak-jakarta-servlet-filter-adapter (24.0.2) +4 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (24.0.2)
org.keycloak:keycloak-policy-enforcer MAVEN version 24.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - org.keycloak:keycloak-adapter-core 24.0.2 -...
org.keycloak:keycloak-adapter-core (23.0.5), org.keycloak:keycloak-jakarta-servlet-filter-adapter (23.0.5) +4 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (23.0.5)
org.keycloak:keycloak-policy-enforcer MAVEN version 23.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - org.keycloak:keycloak-adapter-core 23.0.5 -...
GSSC-CVE-2022-41923
Workaround for CVE-2022-41923: Privilege Management Vulnerability Summary The vulnerability CVE-2022-41923 found in the unpatched Grails Spring Security Core GSSC plugin can result in improper privilege management. This repository describes how to work around the issue. If you are using an...
com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)
com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...
com.vaadin:mpr-v7 (>=7.0.0, <=8.0.1), com.vaadin:vaadin-cdi (1.9.0) +4 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server-mpr-jakarta (>=7.7.37, <=7.7.54)
com.vaadin:vaadin-server-mpr-jakarta MAVEN version =7.7.37, =7.0.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.5.0 Source cves: CVE-2026-110737 Source advisory: MEND:CVE-2026-110737...
This Week in Spring - October 27th, 2026
Hi, Spring fans! Welcome to another installment of This Week in Spring , which I write from the paradise-like environs Barcelona, Spain, where I was lucky enough to be a part of the amazing Vaadin Create event today and tomorrow. It's been an amazing few days, but those few days are just a small...
Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Spring
Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Spring. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2016-5007 DESCRIPTION: Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x,...
com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110803 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)
com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...
org.apache.camel.springboot:camel-undertow-spring-security-starter (>=4.19.0, <=4.22.0), org.apache.camel.springboot:camel-undertow-starter (>=4.19.0, <=4.22.0) +2 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-undertow (>=4.19.0, <=4.22.0)
org.apache.camel:camel-undertow MAVEN version =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.22.0 Source cves: CVE-2026-78164 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429514...
org.apache.camel.springboot:camel-undertow-spring-security-starter (>=4.19.0, <=4.22.0), org.apache.camel.springboot:camel-undertow-starter (>=4.19.0, <=4.22.0) +2 more potentially affected by CVE-2026-78164 via org.apache.camel:camel-undertow (>=4.19.0, <=4.22.0)
org.apache.camel:camel-undertow MAVEN version =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.22.0 Source cves: CVE-2026-78164 Source advisory: MEND:CVE-2026-78164...
