2878 matches found
CVE-2026-111235
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...
CVE-2026-111235 OpenNMS REST authorization bypass via non-canonical HTTP method
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...
CVE-2026-111235 OpenNMS REST authorization bypass via non-canonical HTTP method
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...
CVE-2026-111235 OpenNMS REST authorization bypass via non-canonical HTTP method
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...
EUVD-2026-102324
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...
ROOT-APP-MAVEN-CVE-2024-38821 CVE-2024-38821 in org.springframework.security:spring-security-web - Patched by Root
Root has patched CVE-2024-38821 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-22732 CVE-2026-22732 in org.springframework.security:spring-security-web - Patched by Root
Root has patched CVE-2026-22732 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...
PT-2026-115200
Name of the Vulnerable Software and Affected Versions OpenNMS Meridian versions prior to 2024.3.14, 2025.0.11, and 2026.0.1 OpenNMS Horizon versions prior to 36.0.5 Description An authorization bypass exists in the REST API due to improper configuration of Spring Security filter chains. The /rest...
CVE-2026-111235: Missing Authorization
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...
RHLW-2026-6B59708C7ADB9EB8 Lightwell Security Advisory: spring 5.3.18.rhlw-00010
Red Hat Lightwell has released org.springframework:spring 5.3.18.rhlw-00010 with a backported security fix. CVE-2023-20860: Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in...
RHLW-2026-2CF5E53D95861E97 Lightwell Security Advisory: spring-security-saml2-service-provider 5.7.11.rhlw-00006
Red Hat Lightwell has released org.springframework.security:spring-security-saml2-service-provider 5.7.11.rhlw-00006 with backported fixes for CVE-2026-40988, CVE-2026-41003, and CVE-2026-41694. CVE-2026-40988: Unbounded DEFLATE Inflation in SAML 2.0 Service Provider CVE-2026-41003: Unencoded HTM...
RHLW-2026-351D5430E078D751 Lightwell Security Advisory: spring-security-crypto 5.7.11.rhlw-00006
Red Hat Lightwell has released org.springframework.security:spring-security-crypto 5.7.11.rhlw-00006 with a backported security fix. This patched artifact is a drop-in replacement for org.springframework.security:spring-security-crypto 5.7.11 from Maven Central...
CLEANSTART-2026-FU03579 Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payl...
Security vulnerability affects the apache-nifi package. Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a...
CLEANSTART-2026-OR53843 Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination aft...
Security vulnerability affects the apache-nifi package. Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login...
CLEANSTART-2026-RV47518 When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written
Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...
CLEANSTART-2026-VT93127 Vulnerability in Spring Spring Security
Security vulnerability affects the apache-nifi package. Vulnerability in Spring Spring Security...
CLEANSTART-2026-ZK87180 application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2
Security vulnerability affects the apache-nifi package. An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2...
CLEANSTART-2026-CP43457 attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters
Security vulnerability affects the apache-nifi package. An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters...
PT-2026-117847
Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...
PT-2026-117729
Security vulnerability affects the apache-nifi package. An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters...