2878 matches found
PT-2026-117890
Security vulnerability affects the apache-nifi package. Vulnerability in Spring Spring Security...
PT-2026-117927
Security vulnerability affects the apache-nifi package. An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2...
RHLW-2026-630128D9882E951F Lightwell Security Advisory: spring-security-core 5.7.11.rhlw-00006
Red Hat Lightwell has released org.springframework.security:spring-security-core 5.7.11.rhlw-00006 with backported fixes for CVE-2024-22257, CVE-2024-38827, and CVE-2026-22746. CVE-2026-22746: User Attribute Enumeration when Using DaoAuthenticationProvider This patched artifact is a drop-in...
Spring Security OAuth 2.0.8 Remote Command Execution
Spring Security OAuth version 2.0.8 allows authenticated remote command execution when its whitelabel error view evaluates a malicious responsetype parameter as a Spring Expression Language expression. Included proof of concept generates the expression. https://packetstorm.news/download/234976...
Exploit for CVE-2016-4977
Spring Security OAuth2 Whitelabel SpEL RCE CVE-2016-4977 V...
RHLW-2026-779E7AA7BC83A4C5 Lightwell Security Advisory: spring-security-aspects 5.7.11.rhlw-00006
Red Hat Lightwell has released org.springframework.security:spring-security-aspects 5.7.11.rhlw-00006 with a backported security fix. This patched artifact is a drop-in replacement for org.springframework.security:spring-security-aspects 5.7.11 from Maven Central...
cve-2026-22732-demo
Demo CVE-2026-22732 Riproduzione minima di CVE-2026-22732 — gli header di risposta HTTP di Spring Security vengono eliminati silenziosamente quando il codice del controller scrive direttamente nella risposta del servlet. La Vulnerabilità Spring Security utilizza la scrittura "lazy" degli header p...
CLEANSTART-2026-AA31447 Several components in Spring Security compare security-sensitive values using standard string equality (String
Security vulnerability affects the apache-nifi-registry package. Several components in Spring Security compare security-sensitive values using standard string equality String...
CLEANSTART-2026-ZX09100 Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding
Security vulnerability affects the apache-nifi-registry package. Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding...
CLEANSTART-2026-LZ14873 Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability
Security vulnerability affects the apache-nifi-registry package. Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability...
CLEANSTART-2026-KL61134 application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store
Security vulnerability affects the apache-nifi-registry package. An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store...
CLEANSTART-2026-SI92815 Several components in Spring Security compare security-sensitive values using standard string equality (String
Security vulnerability affects the rundeck package. Several components in Spring Security compare security-sensitive values using standard string equality String...
CLEANSTART-2026-QU78029 application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store
Security vulnerability affects the rundeck package. An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store...
This Week in Spring - October 6th, 2026
Hi, Spring fans! It's another exciting week in the wonderful community, and this week I'm writing from awesome Antwerp, Belgium, site of the legendary Devoxx Belgium show. I've been coming here for most years since 2010, and the show is simultaneously new and exciting every year, while also...
Security Bulletin: Due to the use of Spring Security's WebAuthn, IBM Sterling Control Center is vulnerable to Incorrect Authorization (CVE-2026-47841)
Summary Spring Security's WebAuthn is used by IBM Sterling Control Center as part of dependency in spring-security-web-6.4.12.jar. Vulnerability Details CVEID:CVE-2026-47841 DESCRIPTION: An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when usi...
ROOT-APP-MAVEN-AIKIDO-2026-61483 AIKIDO-2026-61483 in org.springframework.security:spring-security-oauth2-jose - Patched by Root
Root has patched AIKIDO-2026-61483 in the org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available...
CLEANSTART-2026-RR80761 attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters
Security vulnerability affects the apache-nifi package. An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters...
CLEANSTART-2026-SR72438 application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2
Security vulnerability affects the apache-nifi package. An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2...
CLEANSTART-2026-FR51189 Vulnerability in Spring Spring Security
Security vulnerability affects the apache-nifi package. Vulnerability in Spring Spring Security...
CLEANSTART-2026-AQ60759 When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written
Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...