14972 matches found
cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces...
cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader
cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader...
cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader...
cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names
cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names...
cve-2026-47887 - MEDIUM - Spring Framework Open Redirect in UrlFileNameViewController
cve-2026-47887 - MEDIUM - Spring Framework Open Redirect in UrlFileNameViewController...
cve-2026-47890 - LOW - Spring Framework Server Sent Event stream corruption while rendering fragments
cve-2026-47890 - LOW - Spring Framework Server Sent Event stream corruption while rendering fragments...
cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler...
cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification
cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification...
cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder...
Improper Check for Unusual or Exceptional Conditions
Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the DeadLetterPublishingRecovererFactory. An attacker can cause repeated failures and stall partition consumption by attaching a malformed retrytopic-original-timestamp header suc...
Improper Enforcement of Behavioral Workflow
Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Improper Enforcement of Behavioral Workflow via the handling of HTTP PUT requests against immutable aggregate types. An attacker can bypass optimistic-locking...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization of the springjsonheadertypes message header by the JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper. An attacker can cause arbitrary DNS resolution requests by injecting a craft...
CVE-2026-63490: Improper Limitation of a Pathname to a Restricted Directory
Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-bas...
CVE-2026-63337 vulnerabilities
Vulnerabilities for packages: conductor-fips, thingsboard, logstash-fips, zipkin, druid, traccar-fips, nuxeo, traccar, logstash, cassandra-reaper, conductor...
CLSA-2026-1787151813 TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 3 org.springframework.data packages to address 1 CVE. Fixed in 4.4.13-tuxcare.1...
CLSA-2026-1787147294 TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.3.4-tuxcare.1...
CLSA-2026-1787144764 TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 5 org.springframework.data packages to address 1 CVE. Fixed in 4.4.13-tuxcare.1...
CLSA-2026-1787144370 TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.4.13-tuxcare.1...
