EUVD-2026-66836

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSFWSJSONRPCAPITOKEN is not explicitly set, the application resets the...

CVE-2026-16895 Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSFWSJSONRPCAPITOKEN is not explicitly set, the application resets the...

CVE-2026-16895 Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSFWSJSONRPCAPITOKEN is not explicitly set, the application resets the...

PT-2026-82405

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30...

PT-2026-82409

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3....

PT-2026-82406

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE...

PT-2026-82693

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

CVE-2026-47885: Allocation of Resources Without Limits or Throttling

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

CVE-2026-59281: Improper Neutralization of Input During Web Page Generation

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-47892: Incorrect Authorization

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

CVE-2026-59280: Improper Limitation of a Pathname to a Restricted Directory

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...

PT-2026-82407

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

PT-2026-82402

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

CVE-2026-59314: Improper Neutralization of CRLF Sequences in HTTP Headers

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...

CVE-2026-47890: Improper Neutralization of CRLF Sequences

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

CVE-2026-47889: Sensitive Cookie with Improper SameSite Attribute

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

August 27, 2026-KB5122386 Cumulative Update for .NET Framework 4.8.1 for Windows 11, version 26H1

None None...

PT-2026-82692

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-47883: URL Redirection to Untrusted Site

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

CVE-2026-16895: Authentication Bypass by Primary Weakness

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSFWSJSONRPCAPITOKEN is not explicitly set, the application resets the...