PT-2026-102972

Name of the Vulnerable Software and Affected Versions Handlebars.java versions prior to 4.5.5 Description An issue allows directory traversal when using a Spring MVC application with a file: template prefix and a request-derived view name. In certain versions, template locations are validated as...

CLEANSTART-2026-HS17717 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)

Security vulnerability affects the apache-hive package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

CLEANSTART-2026-JK79354 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect

Security vulnerability affects the apache-hive package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...

CLEANSTART-2026-ZQ00581 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...

CLEANSTART-2026-RS34156 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

CLEANSTART-2026-XY63591 Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly speci...

Security vulnerability affects the apache-hive package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...

PT-2026-108440

Security vulnerability affects the apache-hive package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...

PT-2026-108580

Security vulnerability affects the apache-hive package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...

PT-2026-108597

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...

PT-2026-108422

Security vulnerability affects the apache-hive package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

CVE-2026-59313

A flaw was found in the Spring MVC functional web framework. This vulnerability allows for stream corruption when applications use Server-Sent Events SSE, a technology for pushing real-time updates from a server to a client. This could lead to unreliable data delivery and impact the integrity of...

CVE-2026-41841

A flaw was found in Spring MVC and WebFlux applications. A remote attacker could exploit this vulnerability by sending specially crafted requests when the application resolves static resources. This could lead to information disclosure, allowing the attacker to gain unauthorized access to sensiti...

CVE-2026-59281

A flaw was found in Spring MVC and WebFlux applications. When these applications are configured to obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors, they become vulnerable...

com.gitee.jmash:jmash-mvc (>=0.0.2, <=1.0.2) potentially affected by CVE-2026-77762 via org.apache.tomcat.experimental:tomcat-embed-programmatic (>=10.1.16, <=10.1.39)

org.apache.tomcat.experimental:tomcat-embed-programmatic MAVEN version =10.1.16, =0.0.2, =1.0.2 Source cves: CVE-2026-77762 Source advisory: MEND:CVE-2026-77762...

com.gitee.jmash:jmash-mvc (>=0.0.2, <=1.0.2) potentially affected by CVE-2026-77756 via org.apache.tomcat.experimental:tomcat-embed-programmatic (>=10.1.16, <=10.1.39)

org.apache.tomcat.experimental:tomcat-embed-programmatic MAVEN version =10.1.16, =0.0.2, =1.0.2 Source cves: CVE-2026-77756 Source advisory: MEND:CVE-2026-77756...

com.gitee.jmash:jmash-mvc (>=0.0.2, <=1.0.2) potentially affected by CVE-2026-75973 via org.apache.tomcat.experimental:tomcat-embed-programmatic (>=10.1.16, <=10.1.39)

org.apache.tomcat.experimental:tomcat-embed-programmatic MAVEN version =10.1.16, =0.0.2, =1.0.2 Source cves: CVE-2026-75973 Source advisory: MEND:CVE-2026-75973...

CVE-2026-47884

A flaw was found in the XsltView component of Spring MVC applications. This vulnerability could allow a remote, unauthenticated attacker to perform Server-Side Request Forgery SSRF, enabling them to make unauthorized requests from the server, and potentially achieve Remote Code Execution RCE,...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service. The vulnerability is due to stream corruption when Server-Sent Events SSE are used with functional web framework applications in Spring MVC...

CVE-2026-80515: Use of Non-Canonical URL Paths for Authorization Decisions

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL.toString.contains"/mgmt/". Tomcat returns getRequestURL un-decoded, while Spring MVC's...

Malicious Package

Overview bem-mvc-direct is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...