CVE-2026-59313

A flaw was found in the Spring MVC functional web framework. This vulnerability allows for stream corruption when applications use Server-Sent Events SSE, a technology for pushing real-time updates from a server to a client. This could lead to unreliable data delivery and impact the integrity of...

CVE-2026-59278

A flaw was found in Spring for Apache Kafka. The JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper components, which are used by default in @KafkaListener consumers, include java.net in their list of trusted packages. This allows a remote attacker, by sending a specially crafted message, to inje...

CVE-2026-47883

A flaw was found in the UrlHandlerFilter component of Spring Framework. When this filter is configured with overly broad patterns, it can be vulnerable to an open redirect. A remote attacker could exploit this by crafting a malicious URL, which, when clicked by a user, redirects them to an...

CVE-2026-47834

A flaw was found in Spring Data JPA. This vulnerability allows a remote attacker to bypass data validation mechanisms by submitting specially crafted input. This could lead to unauthorized access to limited information and minor disruptions in service availability. Mitigation There is no mitigati...

ROOT-APP-MAVEN-CVE-2026-40973 CVE-2026-40973 in org.springframework.boot:spring-boot - Patched by Root

Root has patched CVE-2026-40973 in the org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2023-20883 CVE-2023-20883 in org.springframework.boot:spring-boot-autoconfigure - Patched by Root

Root has patched CVE-2023-20883 in the org.springframework.boot:spring-boot-autoconfigure package for Root:Maven. Multiple fixed versions available...

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

CVE-2026-41841

A flaw was found in Spring MVC and WebFlux applications. A remote attacker could exploit this vulnerability by sending specially crafted requests when the application resolves static resources. This could lead to information disclosure, allowing the attacker to gain unauthorized access to sensiti...

CVE-2026-97060: Authorization Bypass Through User-Controlled Key

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.

Red Hat build of Apache Camel 4.18.4 for Spring Boot patch release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-59281

A flaw was found in Spring MVC and WebFlux applications. When these applications are configured to obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors, they become vulnerable...

ROOT-APP-MAVEN-AIKIDO-2026-748560 AIKIDO-2026-748560 in org.springframework.integration:spring-integration-core - Patched by Root

Root has patched AIKIDO-2026-748560 in the org.springframework.integration:spring-integration-core package for Root:Maven. Multiple fixed versions available...

Server-Side Request Forgery (SSRF)

Spring Framework is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper handling of XsltView when an application uses an / mapping for view rendering without explicitly specifying the view name, which allows an attacker to trigger unintended server-side requests a...

Improper Authorization

LogNet grpc-spring-boot-starter is vulnerable to improper authorization. The vulnerability is due to improper authorization in the Annotation Processing component, which allows an attacker to remotely bypass authorization controls and gain unauthorized access by exploiting the vulnerable...

Improper Authentication

Spring Cloud Azure is vulnerable to improper authentication. The vulnerability is due to insufficient authentication controls, which allows an unauthorized attacker to elevate privileges over a network...

ROOT-APP-MAVEN-CVE-2026-40998 CVE-2026-40998 in org.springframework.ws:spring-xml - Patched by Root

Root has patched CVE-2026-40998 in the org.springframework.ws:spring-xml package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40994 CVE-2026-40994 in org.springframework.ws:spring-ws-security - Patched by Root

Root has patched CVE-2026-40994 in the org.springframework.ws:spring-ws-security package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40999 CVE-2026-40999 in org.springframework.ws:spring-ws-core - Patched by Root

Root has patched CVE-2026-40999 in the org.springframework.ws:spring-ws-core package for Root:Maven. Multiple fixed versions available...

CVE-2026-96881

A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Executing a manipulation can lead to improper authorization. The attac...

CVE-2026-96882

A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation leads to improper...