19874 matches found
CLSA-2026-1786423284 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 23 org.springframework packages to address 1 CVE. Fixed in 5.2.13.RELEASE-tuxcare.8...
This Week in Spring - August 11th, 2026
Hi, Spring fans! Welcome back to another lively edition of This Week in Spring! So much is always happening in the Spring world, and that’s part of what makes it so fun to follow. One of my favorite things is how much the community contributes and how great it is to connect with everyone. In earl...
CVE-2026-73244: Improper Limitation of a Pathname to a Restricted Directory
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileControllergetFiles to...
CVE-2026-73243: Server-Side Request Forgery (SSRF)
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an...
CLSA-2026-1786369191 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.30-tuxcare.6...
Security Bulletin:Vulnerability in spring affects IBM Netezza Appliance
Summary The spring package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-41850, CVE-2026-41851, CVE-2026-41852 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL...
Security Bulletin:Vulnerability in spring affects IBM Netezza Appliance
Summary The spring package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-41848 Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to...
Spring Cloud Gateway - Actuator SpEL RCE (CVE-2022-22947)
Exploits CVE-2022-22947 by injecting SpEL into a Gateway route filter via the actuator API, reading command output from the route JSON. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud Gateway Actuator SpEL RCE CVE-2022-22947 — opens execute...
Spring Cloud Gateway - Actuator SpEL RCE Detection (CVE-2022-22947)
Detects CVE-2022-22947 by creating a Gateway route with a SpEL AddResponseHeader filter via /actuator/gateway/routes, refreshing, and reading command output from the route definition. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud Gateway Actuator SpEL RCE CVE-2022-22947.""" import jso...
CLSA-2026-1786342480 TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 3 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.4...
CLSA-2026-1786339580 TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 4 CVEs. Fixed in 5.3.24-tuxcare.5...
DoS (Denial of Service) org.springframework:spring-expression Dependency in Bamboo Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 12.0.0, and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to...
DoS (Denial of Service) org.springframework:spring-expression Dependency in Bamboo Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 12.0.0, and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to...
DoS (Denial of Service) org.springframework:spring-webmvc Dependency in Bamboo Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 12.0.0 and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to cau...
Security Bulletin: Vulnerability in Spring-core affects IBM Netezza Appliance
Summary The Spring-core package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-41842 Vulnerability Details CVEID:CVE-2026-41842 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving stati...
Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.
Summary Maximo AI Service uses micrometer-core-1.15.11.jar, spring-core-6.2.18.jar, spring-security-web-6.5.10.jar, spring-data-commons-3.5.11.jar, spring-webmvc-6.2.18.jar, spring-expression-6.2.18.jar and spring-security-config-6.5.10.jar which are vulnerable to CVE-2026-40983, CVE-2026-40984,...
CLSA-2026-1785969383 TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 4 CVEs. Fixed in 5.3.39-tuxcare.18...
CLSA-2026-1785965552 TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 21 org.springframework.security packages to address 4 CVEs. Fixed in 5.7.14-tuxcare.4...