11978 matches found
Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-22745 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an...
Security Bulletin: Insecure Temporary File in Spring Boot affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-40973)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When...
CLSA-2026-1789455724 TuxCare security update for org.springframework.hateoas:spring-hateoas (2 CVEs)
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.2.5-tuxcare.1...
ROOT-APP-MAVEN-CVE-2026-41699 CVE-2026-41699 in org.springframework.graphql:spring-graphql - Patched by Root
Root has patched CVE-2026-41699 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-41700 CVE-2026-41700 in org.springframework.graphql:spring-graphql - Patched by Root
Root has patched CVE-2026-41700 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-41856 CVE-2026-41856 in org.springframework.graphql:spring-graphql - Patched by Root
Root has patched CVE-2026-41856 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available...
CLSA-2026-1789453747 TuxCare security update for org.springframework.amqp (1 CVE)
TuxCare rebuilt 4 org.springframework.amqp packages to address 1 CVE. Fixed in 2.3.7-tuxcare.1...
EUVD-2026-78168
Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...
PT-2026-98446
TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 2 CVEs. Fixed in 2.2.5-tuxcare.1...
This Week in Spring - September 15th, 2026
Hi, Spring fans! Welcome to another rip-roarin' installment of This Week in Spring! I'm writing this to you from sun-kissed San Francisco, CA, sipping some coffee and watching the bay from my breakfast nook. What a wonderful day! A wonderful day in which to learn about the latest and greatest in...
CLSA-2026-1789427454 TuxCare security update for org.springframework (18 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1...
CVE-2026-91145
Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...
CVE-2026-91145
Activiti through 7.1.0.M6 contains an expression injection vulnerability in its mail task handling. The root cause is a failure to validate hash-brace (#{}) deferred expressions in process variables, allowing an attacker to bypass expression filtering. Injected expressions are stored and later ev...
CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task
Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...
CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task
Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...
CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task
Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...
CLSA-2026-1789416166 TuxCare security update for org.springframework (12 CVEs)
TuxCare rebuilt 21 org.springframework packages to address 12 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.5...
CLSA-2026-1789410116 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.8.16-tuxcare.15...