20165 matches found
CVE-2026-44308
Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...
EUVD-2026-30302
Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...
CVE-2026-44308
Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...
CVE-2026-44308
Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...
CVE-2026-44308 Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications
Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...
CVE-2026-44308 Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications
Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...
be.appify.prefab:prefab-sns-sqs (>=0.4.0, <=0.7.1), be.appify.prefab:prefab-test (>=0.4.0, <=0.7.1) +8 more potentially affected by CVE-2026-44308 via io.awspring.cloud:spring-cloud-aws-sns (>=4.0.0, <=4.0.1)
io.awspring.cloud:spring-cloud-aws-sns MAVEN version =4.0.0, =0.4.0, =0.4.0, =4.0.0, =4.0.0, =4.0.0, =2.1.0, =1.3.0, =7.0.0-beta2, =7.0.0-beta2, =7.3.1 Source cves: CVE-2026-44308 Source advisory: MEND:CVE-2026-44308...
CVE-2026-44308 Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications
Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...
CVE-2026-44308
CVE-2026-44308 concerns Spring Cloud AWS, where the SNS HTTP/HTTPS endpoint support methods (@NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping) failed to verify incoming SNS message signatures from versions 3.0.0 through 4.0.1. An unauthent...
CVE-2026-40976
A flaw was found in Spring Boot. Under specific conditions, including being a servlet-based web application without custom Spring Security configuration and relying on the default web security filter chain, a remote attacker could bypass security. This allows unauthorized access to all applicatio...
K000161272: Spring Security vulnerability CVE-2026-22753
Security Advisory Description Vulnerability in Spring Spring Security. If an application is using securityMatchersString and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercise...
Spring Cloud AWS Data Forgery Vulnerability
Spring Cloud AWS is an open-source development framework from awspring, designed for integration with AWS cloud services within the Spring ecosystem. Versions 3.0.0 to 4.0.1 of Spring Cloud AWS contain a data manipulation vulnerability. This vulnerability stems from the lack of validation of the...
Valtimo code injection vulnerability
Valtimo is an open-source low-code platform for business process automation developed by Valtimo in the Netherlands. Versions of Valtimo from 12.0.0 to 12.32.0 contained a code injection vulnerability. This vulnerability stemmed from the use of StandardEvaluationContext to evaluate Spring...
A Bootiful Podcast: the legendary Adib Saikali
Hi, Spring fans! I'm so thrilled to have been able to sit down and talk to my friend Adib Saikali!...
CVE-2026-44308: Insufficient Verification of Data Authenticity
Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...
CVE-2026-44516: Insertion of Sensitive Information into Log File
Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers...
de.skiptag.roadrunner:roadrunner-servlet (0.1), de.skiptag.roadrunner:roadrunner-spring (0.1) +8 more potentially affected by CVE-2026-43512 via org.apache.tomcat:tomcat-catalina (7.0.35)
org.apache.tomcat:tomcat-catalina MAVEN version 7.0.35 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - de.skiptag.roadrunner:roadrunner-servlet 0.1 - de.skiptag.roadrunner:roadrunner-spring 0.1 -...
de.skiptag.roadrunner:roadrunner-servlet (0.1), de.skiptag.roadrunner:roadrunner-spring (0.1) +8 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (7.0.35)
org.apache.tomcat:tomcat-catalina MAVEN version 7.0.35 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - de.skiptag.roadrunner:roadrunner-servlet 0.1 - de.skiptag.roadrunner:roadrunner-spring 0.1 -...
de.skiptag.roadrunner:roadrunner-servlet (0.1), de.skiptag.roadrunner:roadrunner-spring (0.1) +8 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (7.0.35)
org.apache.tomcat:tomcat-catalina MAVEN version 7.0.35 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - de.skiptag.roadrunner:roadrunner-servlet 0.1 - de.skiptag.roadrunner:roadrunner-spring 0.1 -...
com.github.edgar615:spring-boot-util-jwt (>=0.0.1, <=0.0.2), com.github.edgar615:spring-boot-util-web (>=0.1.0, <=0.1.3) +34 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.0.37)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.37 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.github.edgar615:spring-boot-util-jwt =0.0.1, =0.1.0, =2.0.0, =3.0.0-rc.2...