Lucene search
+L

7852 matches found

EUVD
EUVD
added 2026/06/09 3:49 a.m.26 views

EUVD-2026-35325

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

4.8CVSS5.4AI score0.00171EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/09 3:49 a.m.244 views

CVE-2026-41838

Spring Framework's WebSocket session IDs in the spring-websocket module are not cryptographically unpredictable, enabling potential session hijacking in environments with weak authorization. Affected: Spring Framework 7.0.0–7.0.7; 6.2.0–6.2.18; 6.1.0–6.1.27; 5.3.0–5.3.48. Risk summary: predictabl...

7.5CVSS5.5AI score0.00171EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/06/09 3:49 a.m.64 views

CVE-2026-41838 Spring Framework Predictable Session ID in WebSocket Module

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

4.8CVSS0.00171EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/09 3:49 a.m.11 views

CVE-2026-41838 Spring Framework Predictable Session ID in WebSocket Module

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

4.8CVSS5.4AI score0.00171EPSS
SaveExploits0References1
Debian CVE
Debian CVE
added 2026/06/09 3:49 a.m.14 views

CVE-2026-41838

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

7.5CVSS5.4AI score0.00171EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/06/09 3:48 a.m.54 views

CVE-2026-41720 Authentication Bypass with Empty Password in Spring LDAP

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3...

7.4CVSS0.00257EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/09 3:48 a.m.104 views

CVE-2026-41720

CVE-2026-41720 affects Spring LDAP, where DirContextAuthenticationStrategy implementations fail to reject a bind request that uses a non-empty username with an empty or null password. Affected versions include 2.4.0–2.4.4, 3.2.0–3.2.17, 3.3.0–3.3.7, and 4.0.0–4.0.3. The CVE description in both th...

7.4CVSS5.4AI score0.00257EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/09 3:48 a.m.11 views

CVE-2026-41720 Authentication Bypass with Empty Password in Spring LDAP

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3...

7.4CVSS5.4AI score0.00257EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/09 3:48 a.m.21 views

EUVD-2026-35324

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3...

7.4CVSS5.4AI score0.00257EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/09 3:48 a.m.43 views

CVE-2026-41710 Cache Exhaustion in Stateful Retries leads to Denial of Service

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to...

5.9CVSS0.0028EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/09 3:48 a.m.147 views

CVE-2026-41710

The CVE-2026-41710 issue affects Spring Retry versions 2.0.0–2.0.12 and 1.3.0–1.3.4. An attacker can craft a large number of unique requests that trigger failures, exhausting the application-wide stateful retry cache. Once the cache is full, it permanently rejects further updates, causing all lat...

5.9CVSS5.5AI score0.0028EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/09 3:48 a.m.9 views

CVE-2026-41710 Cache Exhaustion in Stateful Retries leads to Denial of Service

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to...

5.9CVSS5.5AI score0.0028EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2026/06/09 12:0 a.m.15 views

Linux Distros Unpatched Vulnerability : CVE-2026-40981

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secret...

7.5CVSS5.5AI score0.00435EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.26 views

PT-2026-48319

Name of the Vulnerable Software and Affected Versions Spring Data MongoDB versions 5.0.0 through 5.0.5 Spring Data MongoDB versions 4.5.0 through 4.5.11 Spring Data MongoDB versions 4.4.0 through 4.4.14 Spring Data MongoDB versions 4.3.0 through 4.3.16 Spring Data MongoDB versions 4.2.0 through...

8.1CVSS6.3AI score0.00328EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.31 views

PT-2026-47646

Name of the Vulnerable Software and Affected Versions Spring Retry versions 2.0.0 through 2.0.12 Spring Retry versions 1.3.0 through 1.3.4 Description An attacker can send a large volume of unique requests that trigger failures, which exhausts the capacity of the application-wide stateful retry...

5.9CVSS5.8AI score0.0028EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/09 12:0 a.m.15 views

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the @Query regex parameter binding when a bound parameter is placed inside a regular expression literal using \Q...\E quoting e.g. @Query" name : /^\\Q?0\\E$/ "...

8.2CVSS5.3AI score0.00262EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.38 views

PT-2026-48325

Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.7.0 through 3.7.19 Spring Data REST versions 4.3.0 through 4.3.16 Spring Data REST versions 4.4.0 through 4.4.14 Spring Data REST versions 4.5.0 through 4.5.11 Spring Data REST versions 5.0.0 through 5.0.5 Descripti...

8.1CVSS5.9AI score0.00393EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/06/09 12:0 a.m.8 views

CVE-2026-41847

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48...

5.3CVSS6.1AI score0.00166EPSS
SaveExploits0References2
CNNVD
CNNVD
added 2026/06/09 12:0 a.m.20 views

VMware Spring Retry 安全漏洞

VMware Spring Retry is an application fault tolerance and retry framework developed by the American company VMware. Versions 2.0.0 to 2.0.12 and 1.3.0 to 1.3.4 of VMware Spring Retry contain security vulnerabilities. These vulnerabilities arise from triggering failures due to a large number of...

5.9CVSS5.4AI score0.0028EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/06/09 12:0 a.m.18 views

Spring Framework 访问控制错误漏洞

The Spring Framework is an application development framework developed by Spring in open source. Versions 5.3.0 to 5.3.48 of the Spring Framework contain a security access control vulnerability. This vulnerability arises from potential security bypasses when using the Kotlin Router DSL...

5.3CVSS5.3AI score0.00166EPSS
SaveExploits0References1
Rows per page
Query Builder