CVE-2026-59313 Server Sent Event stream corruption in Spring MVC functional web framework

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

EUVD-2026-67193

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

EUVD-2026-67192

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

CVE-2026-59307

Spring Integration JdbcMessageStore has a deserialization allow-list bypass. When the store is a Spring-managed bean , calling addAllowedPatterns(...) to restrict deserialization is silently ineffective because setBeanClassLoader (invoked during Spring's bean lifecycle) replaces the deserializer ...

CVE-2026-59305

Spring Cloud Stream versions 4.2.0–4.2.6, 4.3.0–4.3.3, and 5.0.0–5.0.2 are affected by an issue where the partition interceptor may be improperly added while sending a message. The vulnerability is rated LOW severity (CVSS 3.1: 3.1), requiring high privileges, user interaction, and presenting hig...

EUVD-2026-67191

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59305 Partition interceptor may be improperly added while sending message

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59304 Improper caching of the original content type in Spring Cloud Stream Avro

Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

EUVD-2026-67190

Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59304

Spring Cloud Stream Avro is affected by an improper caching of the original content type, leading to potential confidentiality and integrity impact at a low severity (CVSS 3.1). The affected versions are Spring Cloud Stream 5.0.0–5.0.2 , 4.3.0–4.3.3 , and 4.2.0–4.2.6 . The CVSS vector (AV:N/AC:H/...

CVE-2026-59303

Spring Cloud Stream contains a vulnerability where the dynamic destination cache size is not properly bounded, affecting versions 5.0.0–5.0.2 , 4.3.0–4.3.3 , and 4.2.0–4.2.6 . The flaw allows an unbounded cache to grow, which could lead to resource exhaustion under specific conditions. The CVSS 3...

EUVD-2026-67189

Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59303 Dynamic destination cache size is not properly bound in Spring Cloud Stream

Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59302 Potential for logging sensitive data in Spring Cloud Stream

Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

cve-2019-2618

cve-2019-2618 Vulnerabilità di upload su Weblogic richiede nome utente e password - CVE-2019-2618 Utilizzo con Python root@kitploit: python CVE-2019-2618.py url username password Decifrare la password di Weblogic root@kitploit: root@f0cb7e674d7e:/Oracle cat...

CVE-2026-59302

CVE-2026-59302 affects Spring Cloud Stream versions 5.0.0–5.0.2, 4.3.0–4.3.3, and 4.2.0–4.2.6, where the logging functionality may record sensitive data. The CVSS 3.1 base score is 3.1 (LOW) , with a network attack vector, high attack complexity, high privileges required, and user interaction req...

EUVD-2026-67188

Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

EUVD-2026-67186

Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

CVE-2026-59301

Spring Cloud Function Azure is susceptible to a sensitive data logging issue, where potentially sensitive information may be written to logs. The vulnerability affects Spring Cloud Function versions 5.0.0–5.0.3, 4.3.0–4.3.4, and 4.2.0–4.2.7. The CNA-assigned CVSS 3.1 score is 3.1 (LOW) , reflecti...