CVE-2026-8759

A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of specia...

This Week in Spring - May 19th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring!, this one written from the back of a taxi racing to the local Frankfurt train station, where I'll take a train to Munich for the amazing Kotlin Conf 2026 edition, where I'll be part of the keynote and deliver a talk on the...

Spring Office Hours Podcast: S5E16 - May Release Train Shift & What's Coming in Spring Boot 4.1

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun break down the recently announced shift of the May release train from May 11-22 to June 1-5, and what that means for your upgrade planning across the Spring portfolio. They also dig...

org.springaicommunity:mcp-client-security-boot (0.1.4), org.springaicommunity:mcp-client-security-spring-boot (0.1.5) potentially affected by CVE-2026-45609 via org.springaicommunity:mcp-client-security (>=0.1.4, <=0.1.5)

org.springaicommunity:mcp-client-security MAVEN version =0.1.4, =0.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springaicommunity:mcp-client-security and may be impacted: - org.springaicommunity:mcp-client-security-boot 0.1.4 -...

org.springaicommunity:mcp-client-security-boot (0.1.4), org.springaicommunity:mcp-client-security-spring-boot (0.1.5) potentially affected by CVE-2026-45609 via org.springaicommunity:mcp-client-security (>=0.1.4, <=0.1.5)

org.springaicommunity:mcp-client-security MAVEN version =0.1.4, =0.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springaicommunity:mcp-client-security and may be impacted: - org.springaicommunity:mcp-client-security-boot 0.1.4 -...

org.springaicommunity:mcp-client-security-boot (0.1.4), org.springaicommunity:mcp-client-security-spring-boot (0.1.5) potentially affected by CVE-2026-45609 via org.springaicommunity:mcp-client-security (>=0.1.4, <=0.1.5)

org.springaicommunity:mcp-client-security MAVEN version =0.1.4, =0.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springaicommunity:mcp-client-security and may be impacted: - org.springaicommunity:mcp-client-security-boot 0.1.4 -...

Exploit for Improper Input Validation in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

🚀 Automated Log4Shell CVE-2021-44228 Play & Plug Lab An aut...

com.ibeetl:beetl-online-web (3.15.3.release), com.ibeetl:beetl-spring-boot-starter-classic (>=3.14.1.release, <=3.21.0.release) potentially affected by CVE-2026-8759 via com.ibeetl:beetl-spring-classic (>=3.14.1.release, <=3.21.0.release)

com.ibeetl:beetl-spring-classic MAVEN version =3.14.1.release, =3.14.1.release, =3.21.0.release Source cves: CVE-2026-8759 Source advisory: SNYK:JAVA-COMIBEETL-17326831...

Beetl's SpELFunction extension function has an expression injection risk

A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of specia...

GHSA-FMMW-44RP-JCFP Beetl's SpELFunction extension function has an expression injection risk

A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of specia...

com.ibeetl:beetl-online-web (3.15.3.release), com.ibeetl:beetl-spring-boot-starter-classic (>=3.14.1.release, <=3.20.2.release) potentially affected by CVE-2026-8759 via com.ibeetl:beetl-spring-classic (>=3.14.1.release, <=3.20.2.release)

com.ibeetl:beetl-spring-classic MAVEN version =3.14.1.release, =3.14.1.release, =3.20.2.release Source cves: CVE-2026-8759 Source advisory: OSV:GHSA-FMMW-44RP-JCFP...

com.ibeetl:beetl-online-web (3.15.3.release), com.ibeetl:beetl-spring-boot-starter-classic (>=3.14.1.release, <=3.20.2.release) potentially affected by CVE-2026-8759 via com.ibeetl:beetl-spring-classic (>=3.14.1.release, <=3.20.2.release)

com.ibeetl:beetl-spring-classic MAVEN version =3.14.1.release, =3.14.1.release, =3.20.2.release Source cves: CVE-2026-8759 Source advisory: GHSA-FMMW-44RP-JCFP...

CVE-2026-8759 xiandafu beetl SpELFunction SpELFunction.java expression language injection

A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of specia...

CVE-2026-8759

Technical details are not publicly available in the provided documents; no affected versions, vectors, or fixes are specified beyond the description. Monitor for updates.

CVE-2026-8759: Improper Neutralization of Special Elements used in an Expression Language Statement

A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of specia...

Information Exposure

Spring Cloud Config is vulnerable to Information Exposure. The vulnerability is due to improper validation of requests when using Google Secrets Manager as a backend, which allows an attacker to craft requests that expose secrets from unintended GCP projects...

Race Condition

Spring Cloud Config Server is vulnerable to Race Condition. The vulnerability is due to a Time-of-Check Time-of-Use TOCTOU issue in handling the Git repository base directory spring.cloud.config.server.git.basedir, where attackers may manipulate filesystem state between validation and use,...

CVE-2026-44516

Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers...

CVE-2026-34263

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application...

Spring Framework 5.3.x < 5.3.48 / 6.1.x < 6.1.27 / 6.2.x < 6.2.18 / 7.0.x < 7.0.7 Multiple DoS

The version of Spring Framework installed on the remote host is 5.3.x prior to 5.3.48, 6.1.x prior to 6.1.27, 6.2.x prior to 6.2.18, or 7.0.x prior to 7.0.7. It is, therefore, affected by multiple vulnerabilities: - A WebFlux server application that processes multipart requests creates temp files...