CVE-2026-45609

mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI. Prior to 0.1.9, the mcp-security framework fails to implement the mandatory SSRF mitigations outlined in the Model Context Protocol MCP security specifications. Specifically, it processes untrusted...

org.springaicommunity:mcp-client-security-boot (0.1.4), org.springaicommunity:mcp-client-security-spring-boot (0.1.5) potentially affected by CVE-2026-45609 via org.springaicommunity:mcp-client-security (>=0.1.4, <=0.1.5)

org.springaicommunity:mcp-client-security MAVEN version =0.1.4, =0.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springaicommunity:mcp-client-security and may be impacted: - org.springaicommunity:mcp-client-security-boot 0.1.4 -...

CVE-2026-45609

mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI. Prior to 0.1.9, the mcp-security framework fails to implement the mandatory SSRF mitigations outlined in the Model Context Protocol MCP security specifications. Specifically, it processes untrusted...

📄 Apache ActiveMQ Jolokia AddNetworkConnector Remote Code Execution

Apache ActiveMQ exposes a Jolokia JMX-over-HTTP API at /api/jolokia/. An authenticated attacker can invoke the addNetworkConnector MBean operation with a crafted URI that causes the broker to fetch a remote Spring XML configuration over HTTP. The Spring XML instantiates a ProcessBuilder bean that...

CVE-2026-45609: Server-Side Request Forgery (SSRF)

mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI. Prior to 0.1.9, the mcp-security framework fails to implement the mandatory SSRF mitigations outlined in the Model Context Protocol MCP security specifications. Specifically, it processes untrusted...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.3 Vulnerability Details CVEID:CVE-2026-40972 DESCRIPTION: An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extrem...

osv-java-poc

OSV Scanner CVE Detection POC — Vulnerable Java App ⚠️ WA...

A Bootiful Podcast: Microsoft's Martijn Verburg

Hi Spring fans! In this installment, I talk to my friend from JClarity and Microsoft fame, fellow Java champion, and Java guru Martijn Verburg ai microsoft java jclarity performance...

Security Bulletin: Maximo AI Service uses uuid-11.1.0.tgz and spring-webmvc-6.2.17.jar which are vulnerable to CVE-2026-41988 and CVE-2026-22741.

Summary Maximo AI Service uses uuid-11.1.0.tgz and spring-webmvc-6.2.17.jar which are vulnerable to CVE-2026-41988 and CVE-2026-22741. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-22741 DESCRIPTION: Spring MVC and WebFlux...

Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in spring-boot (CVE-2026-40973, CVE-2026-40975, CVE-2026-40977)

Summary IBM Sterling Control Center is affected by vulnerabilities CVE-2026-40973, CVE-2026-40975, CVE-2026-40977 reported for spring-boot-3.4.11.jar. Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take control of the...

Security Bulletin: IBM Sterling Control Center is affected by a vulnerability in spring-boot-autoconfigure (CVE-2026-40974)

Summary IBM Sterling Control Center is affected by a vulnerability CVE-2026-40974 reported for spring-boot-autoconfigure-3.4.11.jar. Vulnerability Details CVEID:CVE-2026-40974 DESCRIPTION: Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL...

Exploit for Code Injection in Vmware Spring_Framework

PoC — CVE-2022-22965 Spring4Shell Disclaimer: This re...

com.nb6868.onex:common (5.0.3), com.nb6868.onex:file-converter (5.0.3) +14 more potentially affected by CVE-2026-43828 via org.apache.shiro:shiro-web (3.0.0-alpha-1)

org.apache.shiro:shiro-web MAVEN version 3.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-web and may be impacted: - com.nb6868.onex:common 5.0.3 - com.nb6868.onex:file-converter 5.0.3 - com.nb6868.onex:job 5.0.3 -...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0-m0, <=4.0.5), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0-m0, <=4.0.5) +33 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=4.0.0-m0, <=4.0.5)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.5 and more Source cves: CVE-2026-42782https://vulne...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.0), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.0) +33 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.0)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0 and more Source cves: CVE-2026-42782https://vu...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=3.0.16), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=3.0.16) +30 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=3.0.0-m0, <=3.0.16)

org.apache.syncope.core:syncope-core-spring MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0, =3.0.16 and more Source cves:...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=3.0.16), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=3.0.16) +30 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=3.0.0-m0, <=3.0.16)

org.apache.syncope.core:syncope-core-spring MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0, =3.0.16 and more Source cves:...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0-m0, <=4.0.5), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0-m0, <=4.0.5) +33 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=4.0.0-m0, <=4.0.5)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.5 and more Source cves: CVE-2026-42782https://vulne...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.0), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.0) +33 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.0)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0 and more Source cves: CVE-2026-42782https://vu...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +47 more potentially affected by CVE-2026-41863 via org.springframework.ai:spring-ai-anthropic (>=1.1.0, <=1.1.6)

org.springframework.ai:spring-ai-anthropic MAVEN version =1.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.6.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =0.4.0 and more Source cves: CVE-2026-41863 Source advisory: OSV:GHSA-CC4M-MP48-X7QG...