Lucene search
+L

7852 matches found

CVE
CVE
added 2026/06/09 3:49 a.m.244 views

CVE-2026-41838

Spring Framework's WebSocket session IDs in the spring-websocket module are not cryptographically unpredictable, enabling potential session hijacking in environments with weak authorization. Affected: Spring Framework 7.0.0–7.0.7; 6.2.0–6.2.18; 6.1.0–6.1.27; 5.3.0–5.3.48. Risk summary: predictabl...

7.5CVSS5.5AI score0.00171EPSS
SaveExploits0References1Affected Software1
EUVD
EUVD
added 2026/06/09 3:49 a.m.26 views

EUVD-2026-35325

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

4.8CVSS5.4AI score0.00171EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/09 3:49 a.m.64 views

CVE-2026-41838 Spring Framework Predictable Session ID in WebSocket Module

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

4.8CVSS0.00171EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/09 3:49 a.m.11 views

CVE-2026-41838 Spring Framework Predictable Session ID in WebSocket Module

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

4.8CVSS5.4AI score0.00171EPSS
SaveExploits0References1
Debian CVE
Debian CVE
added 2026/06/09 3:49 a.m.14 views

CVE-2026-41838

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

7.5CVSS5.4AI score0.00171EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/06/09 3:48 a.m.54 views

CVE-2026-41720 Authentication Bypass with Empty Password in Spring LDAP

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3...

7.4CVSS0.00257EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/09 3:48 a.m.104 views

CVE-2026-41720

CVE-2026-41720 affects Spring LDAP, where DirContextAuthenticationStrategy implementations fail to reject a bind request that uses a non-empty username with an empty or null password. Affected versions include 2.4.0–2.4.4, 3.2.0–3.2.17, 3.3.0–3.3.7, and 4.0.0–4.0.3. The CVE description in both th...

7.4CVSS5.4AI score0.00257EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/09 3:48 a.m.11 views

CVE-2026-41720 Authentication Bypass with Empty Password in Spring LDAP

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3...

7.4CVSS5.4AI score0.00257EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/09 3:48 a.m.21 views

EUVD-2026-35324

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3...

7.4CVSS5.4AI score0.00257EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/09 3:48 a.m.43 views

CVE-2026-41710 Cache Exhaustion in Stateful Retries leads to Denial of Service

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to...

5.9CVSS0.0028EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/09 3:48 a.m.147 views

CVE-2026-41710

The CVE-2026-41710 issue affects Spring Retry versions 2.0.0–2.0.12 and 1.3.0–1.3.4. An attacker can craft a large number of unique requests that trigger failures, exhausting the application-wide stateful retry cache. Once the cache is full, it permanently rejects further updates, causing all lat...

5.9CVSS5.5AI score0.0028EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/09 3:48 a.m.9 views

CVE-2026-41710 Cache Exhaustion in Stateful Retries leads to Denial of Service

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to...

5.9CVSS5.5AI score0.0028EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2026/06/09 12:0 a.m.15 views

Linux Distros Unpatched Vulnerability : CVE-2026-40981

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secret...

7.5CVSS5.5AI score0.00435EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.26 views

PT-2026-48319

Name of the Vulnerable Software and Affected Versions Spring Data MongoDB versions 5.0.0 through 5.0.5 Spring Data MongoDB versions 4.5.0 through 4.5.11 Spring Data MongoDB versions 4.4.0 through 4.4.14 Spring Data MongoDB versions 4.3.0 through 4.3.16 Spring Data MongoDB versions 4.2.0 through...

8.1CVSS6.3AI score0.00328EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/06/09 12:0 a.m.7 views

CVE-2026-41838

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

7.5CVSS6AI score0.00171EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.31 views

PT-2026-47646

Name of the Vulnerable Software and Affected Versions Spring Retry versions 2.0.0 through 2.0.12 Spring Retry versions 1.3.0 through 1.3.4 Description An attacker can send a large volume of unique requests that trigger failures, which exhausts the capacity of the application-wide stateful retry...

5.9CVSS5.8AI score0.0028EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/09 12:0 a.m.15 views

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the @Query regex parameter binding when a bound parameter is placed inside a regular expression literal using \Q...\E quoting e.g. @Query" name : /^\\Q?0\\E$/ "...

8.2CVSS5.3AI score0.00262EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.24 views

PT-2026-48307

Name of the Vulnerable Software and Affected Versions Spring Security versions 7.0.0 through 7.0.5 Description An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository saml2 asserting party metadata can store malicious serialized payloads. This occu...

7.3CVSS5.8AI score0.00198EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.38 views

PT-2026-48325

Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.7.0 through 3.7.19 Spring Data REST versions 4.3.0 through 4.3.16 Spring Data REST versions 4.4.0 through 4.4.14 Spring Data REST versions 4.5.0 through 4.5.11 Spring Data REST versions 5.0.0 through 5.0.5 Descripti...

8.1CVSS5.9AI score0.00393EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/09 12:0 a.m.35 views

PT-2026-48316

Name of the Vulnerable Software and Affected Versions Spring Data Commons versions 4.0.0 through 4.0.5 Spring Data Commons versions 3.5.0 through 3.5.11 Spring Data Commons versions 3.4.0 through 3.4.14 Spring Data Commons versions 3.3.0 through 3.3.16 Spring Data Commons versions 3.2.0 through...

5.9CVSS5.8AI score0.0028EPSS
SaveExploits0References4
Rows per page
Query Builder