Race Condition

Overview Affected versions of this package are vulnerable to Race Condition via the ScriptEngine process. An attacker can access sensitive data from other requests or cause unexpected exceptions by triggering concurrent script evaluations. Remediation Upgrade...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the decodeNativeFormat. An attacker can inject arbitrary entries into MessageHeaders, including sensitive control headers, by sending...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the RFC6587SyslogDeserializer. An attacker can cause excessive memory consumption and potentially exhaust system resources by sending frames with arbitrarily large declared lengths...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonToObjectTransformer. An attacker can execute arbitrary code or instantiate unexpected classes by supplying a crafted jsonTypeId message header that is mapped from an external source, such as...

cve-2026-47864 - MEDIUM - Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

cve-2026-47864 - MEDIUM - Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution...

cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=12.1.0), com.almis.awe.clients:test-react (>=0.0.11, <=1.0.5) +156 more potentially affected by CVE-2026-59270 via org.springframework.security:spring-security-ldap (>=5.7.0, <=7.0.6)

org.springframework.security:spring-security-ldap MAVEN version =5.7.0, =1.0.0.ee-20260424025040, =0.0.11, =4.6.0, =4.6.0, =4.6.0, =4.6.0, =4.6.0, =4.6.0, =4.6.0, =4.6.0, =4.6.0, =4.6.0, =4.6.0, =4.6.0, =4.6.0, =4.13.1 and more Source cves: CVE-2026-59270 Source advisory:...

com.oracle.database.spring.cloud-stream-binder:spring-cloud-stream-binder-oracle-txeventq (>=0.17.0, <=0.19.0), org.springframework.cloud.fn:spring-jms-supplier (6.0.0) potentially affected by CVE-2026-47880 via org.springframework.integration:spring-integration-jms (>=7.0.2, <=7.0.4)

org.springframework.integration:spring-integration-jms MAVEN version =7.0.2, =0.17.0, =0.19.0 - org.springframework.cloud.fn:spring-jms-supplier 6.0.0 Source cves: CVE-2026-47880 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-19267412...

org.springframework.cloud.fn:spring-syslog-supplier (6.0.0), org.springframework.cloud.fn:spring-tcp-common (6.0.0) +7 more potentially affected by CVE-2026-47861 via org.springframework.integration:spring-integration-ip (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-ip MAVEN version =7.0.0-m1, =7.0.0-m1, =7.0.5 Source cves: CVE-2026-47861 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-19267411...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the DeadLetterPublishingRecovererFactory. An attacker can cause repeated failures and stall partition consumption by attaching a malformed retrytopic-original-timestamp header suc...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization of the springjsonheadertypes message header by the JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper. An attacker can cause arbitrary DNS resolution requests by injecting a craft...

Uncontrolled Recursion

Overview org.springframework.ai:spring-ai-pdf-document-reader is a Spring AI PDF document reader Affected versions of this package are vulnerable to Uncontrolled Recursion in an ingestion thread. An attacker can cause a denial of service by submitting a PDF with a deeply nested or cyclic table of...

Cross-site Request Forgery (CSRF)

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the GraphiQL process. An attacker can access confidential information by enticing a victim with an active sessio...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through the spring.cloud.config.server.svn.basedir...

Access Control Bypass

Overview org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Access Control Bypass in the InetAddressMatchers process. An attacker can bypass network-based access control...

Information Exposure

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

Unsafe Dependency Resolution

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the GraphiQL. An attacker can execute arbitrary JavaScript code in the context of users' browsers by compromising t...

Missing Authentication for Critical Function

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the monitor endpoint, which does not validate incomi...

Directory Traversal

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Directory Traversal via the native environment repository process. An attacker can access sensitive...

Improper Neutralization

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Improper Neutralization in the...