Lucene search
+L

7026 matches found

OSV
OSV
added 2026/08/24 12:32 p.m.26 views

ROOT-APP-MAVEN-CVE-2026-22732 CVE-2026-22732 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2026-22732 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

9.1CVSS8.5AI score0.0048EPSS
SaveExploits2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.54 views

WebMvc.fn/WebFlux.fn - Path Traversal

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

7.5CVSS6.9AI score0.14718EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.53 views

Spring Framework - Path Traversal

Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires...

5.9CVSS6.1AI score0.02054EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.37 views

Spring Cloud Gateway Server Webflux - Broken Access Control

Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure. id: CVE-2025-41243 info: name:...

10CVSS8.6AI score0.03548EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.31 views

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

9.8CVSS9.7AI score0.53936EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.151 views

Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution

Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view...

8.8CVSS8.3AI score0.13035EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.47 views

Java-springboot-codebase 1.1 - Arbitrary File Read

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized...

8.7CVSS8.5AI score0.04028EPSS
SaveExploits29References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.64 views

Spring Data Commons - Remote Code Execution

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...

9.8CVSS9.3AI score0.95715EPSS
SaveExploits9References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.60 views

Spring Cloud Config Server - Local File Inclusion

Spring Cloud Config Server versions 2.1.x prior to 2.1.2, 2.0.x prior to 2.0.4, 1.4.x prior to 1.4.6, and older unsupported versions are vulnerable to local file inclusion because they allow applications to serve arbitrary configuration files. An attacker can send a request using a specially...

6.5CVSS6.3AI score0.85295EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.59 views

Spring Cloud Config Server - Path Traversal

Spring Cloud 3.1.x 3.1.13, 4.1.x 4.1.9, 4.2.x 4.2.3, 4.3.x 4.3.2, and 5.0.x 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request. i...

8.6CVSS8AI score0.0122EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.48 views

Apache ActiveMQ - Remote Code Execution

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...

8.8CVSS7.7AI score0.9722EPSS
SaveExploits14References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.12 views

Spring Framework Path Traversal in Functional Web Frameworks

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

7.5CVSS6.3AI score0.54862EPSS
SaveExploits6References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.113 views

Spring MVC Framework - Local File Inclusion

Spring MVC Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported are vulnerable to local file inclusion because they allow applications to configure Spring MVC to serve static resources e.g. CSS, JS, images. A malicious user can send a request using a...

5.9CVSS7.2AI score0.34505EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.106 views

Spring Boot Actuator Logview Directory Traversal

spring-boot-actuator-logview before version 0.2.13 contains a directory traversal vulnerability in libraries that adds a simple logfile viewer as a spring boot actuator endpoint maven package "eu.hinsch:spring-boot-actuator-logview". id: CVE-2021-21234 info: name: Spring Boot Actuator Logview...

7.7CVSS7.7AI score0.21173EPSS
SaveExploits2References6
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.111 views

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

10CVSS8.6AI score0.98253EPSS
SaveExploits54References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.180 views

Spring Security OAuth2 Remote Command Execution

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...

8.8CVSS8.3AI score0.71757EPSS
SaveExploits1References5
Spring Security Advisories
Spring Security Advisories
added 2026/08/23 5:39 p.m.18 views

CVE-2014-0225

CVE-2014-0225...

8.8CVSS8AI score0.01756EPSS
SaveExploits0
Spring Security Advisories
Spring Security Advisories
added 2026/08/23 9:39 a.m.8 views

CVE-2026-59317

CVE-2026-59317...

5.2AI score
SaveExploits0
Spring Security Advisories
Spring Security Advisories
added 2026/08/23 9:39 a.m.11 views

CVE-2026-59322

CVE-2026-59322...

5.2AI score
SaveExploits0
Spring Security Advisories
Spring Security Advisories
added 2026/08/23 9:39 a.m.7 views

CVE-2026-59320

CVE-2026-59320...

5.2AI score
SaveExploits0
Rows per page
Query Builder