com.buession.cas:cas-server-support-captcha (4.0.0), com.buession.cas:cas-server-support-captcha-core (4.0.0) +449 more potentially affected by CVE-2026-40986 via org.springframework.webflow:spring-webflow (>=3.0.0, <=3.0.1)

org.springframework.webflow:spring-webflow MAVEN version =3.0.0, =6.2.0, =4.0.0-m0, =4.1.3 and more Source cves: CVE-2026-40986 Source advisory: MEND:CVE-2026-40986...

CVE-2026-40986 Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...

EUVD-2026-36201

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...

CVE-2026-40986

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...

org.apereo.cas:cas-server-core (>=8.0.0-rc1, <=8.0.0-rc5), org.apereo.cas:cas-server-core-api (>=8.0.0-rc1, <=8.0.0-rc5) +342 more potentially affected by CVE-2026-40986 via org.springframework.webflow:spring-webflow (4.0.0)

org.springframework.webflow:spring-webflow MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.webflow:spring-webflow and may be impacted: - org.apereo.cas:cas-server-core =8.0.0-rc1, =8.0.0-rc1, =8.0.0-rc1,...

CVE-2026-40986 Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...

CVE-2026-40985 Data Binding Vulnerability in Spring Web Flow with Unified EL Parser

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1...

CVE-2026-40985

CVE-2026-40985 affects Spring Web Flow where configurations use the WebFlowELExpressionParser. The vulnerability arises from processing Unified EL expressions, allowing a crafted expression to influence behavior. Affected versions are Spring Web Flow 4.0.0; 3.0.0–3.0.1; and 2.5.0–2.5.1. The conne...

EUVD-2026-36200

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1...

CVE-2026-40985

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1...

CVE-2026-40985 Data Binding Vulnerability in Spring Web Flow with Unified EL Parser

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1...

org.apereo.cas:cas-server-core (>=8.0.0-rc1, <=8.0.0-rc5), org.apereo.cas:cas-server-core-api (>=8.0.0-rc1, <=8.0.0-rc5) +342 more potentially affected by CVE-2026-40985 via org.springframework.webflow:spring-webflow (4.0.0)

org.springframework.webflow:spring-webflow MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.webflow:spring-webflow and may be impacted: - org.apereo.cas:cas-server-core =8.0.0-rc1, =8.0.0-rc1, =8.0.0-rc1,...

com.buession.cas:cas-server-support-captcha (4.0.0), com.buession.cas:cas-server-support-captcha-core (4.0.0) +449 more potentially affected by CVE-2026-40985 via org.springframework.webflow:spring-webflow (>=3.0.0, <=3.0.1)

org.springframework.webflow:spring-webflow MAVEN version =3.0.0, =6.2.0, =4.0.0-m0, =4.1.3 and more Source cves: CVE-2026-40985 Source advisory: MEND:CVE-2026-40985...

CVE-2026-40985 Data Binding Vulnerability in Spring Web Flow with Unified EL Parser

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1...

CVE-2026-41694

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0...

CVE-2026-41719

A flaw was found in Spring Data KeyValue. This vulnerability, known as a Spring Expression Language SpEL Injection, allows a remote attacker with low privileges to execute arbitrary expressions. This occurs when unsanitized user input is passed as a sorting parameter into a repository query metho...

CVE-2026-41711

A flaw was found in Spring Data Commons. Applications using this component may be vulnerable to a Denial of Service DoS attack. A remote attacker could exploit this by sending specially crafted Sort parameters, leading to a StackOverflowException and causing the application to become unavailable...

CVE-2026-41706

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is us...

CVE-2026-41697

A flaw was found in Spring Data Relational. This vulnerability allows a remote attacker to perform boolean-based blind data inference by supplying wildcard characters in externally-controlled input when using StringMatcher in Query By Example QBE. This can lead to the disclosure of sensitive...

CVE-2026-41008

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can lead to an Open Redirect...