Lucene search
+L

2089 matches found

RedhatCVE
RedhatCVE
added 2026/07/17 1:19 p.m.14 views

CVE-2026-41846

A flaw was found in Spring MVC applications, part of the Spring Framework. This vulnerability allows a remote attacker to inject arbitrary HTML or JavaScript code due to improper handling of user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags. Successful...

6.8CVSS5.2AI score0.00152EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/07/17 1:19 p.m.17 views

CVE-2026-41854

A flaw was found in Spring Framework. Due to incorrect host parsing in the UriComponentsBuilder component, applications that process externally provided URL strings may be vulnerable to a Server-Side Request Forgery SSRF attack. An SSRF attack allows an attacker to trick the server into making...

6.5CVSS4.9AI score0.00123EPSS
SaveExploits0References4
Spring Security Advisories
Spring Security Advisories
added 2026/07/13 12:00 a.m.27 views

Spring Office Hours Podcast: S5E18 - The Latest from OpenAI, Anthropic and Spring AI 2.0

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun catch up on the fast moving world of AI and what it means for Java developers. The guys will cover recent releases from OpenAI and Anthropic, then dig into Spring AI 2.0, which is n...

6.1AI score
SaveExploits0
F5 Networks
F5 Networks
added 2026/07/10 7:51 a.m.16 views

K000162181: Spring Framework vulnerability CVE-2026-41841

Security Advisory Description Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48. CVE-2026-41841 Impact Ther...

5.9CVSS6.1AI score0.00339EPSS
SaveExploits0
F5 Networks
F5 Networks
added 2026/07/09 6:31 p.m.14 views

K000162161: Spring Framework vulnerability CVE-2026-41839

Security Advisory Description A WebFlux application with a compromised subdomain for example, compromised via cross-site scripting XSS is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7;...

4.2CVSS5.8AI score0.00213EPSS
SaveExploits0
F5 Networks
F5 Networks
added 2026/07/09 10:03 a.m.18 views

K000162156: Spring Framework vulnerability CVE-2026-41844

Security Advisory Description A Spring MVC or Spring WebFlux application which configures a mapping for "/" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix. Affected versions:...

6.1CVSS6AI score0.00145EPSS
SaveExploits0
F5 Networks
F5 Networks
added 2026/07/07 8:00 p.m.16 views

K000162130: Spring Framework vulnerability CVE-2026-41851

Security Advisory Description Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth. Affected versions: Spring Framework 7.0.0 through 7.0.7;...

7.5CVSS5.9AI score0.0036EPSS
SaveExploits0
GithubExploit
GithubExploit
added 2026/07/07 9:12 a.m.78 views

Exploit for Code Injection in Vmware Spring_Framework

explo...

9.8CVSS7AI score0.99638EPSS
SaveExploits105
F5 Networks
F5 Networks
added 2026/07/02 8:45 a.m.26 views

K000162041: Spring Framework vulnerabilities CVE-2026-41843 and CVE-2026-41846

Security Advisory Description CVE-2026-41843 Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48. CVE-2026-41846 Spri...

6.1CVSS5.9AI score0.00369EPSS
SaveExploits0
Spring Security Advisories
Spring Security Advisories
added 2026/07/02 12:00 a.m.12 views

A Bootiful Podcast: Sébastien Deleuze on the latest-and-greatest in Spring AI and Spring Framework

Hi Spring fans! In this installment we talk to the legendary Spring AI and Spring Framework contributor Sébastien Deleuze about the latest-and-greatest in AI, Kotlin, the framework, and more...

5.8AI score
SaveExploits0
Atlassian
Atlassian
added 2026/06/30 12:32 a.m.13 views

Injection logback-core Dependency in Confluence Data Center

This High severity Injection vulnerability was introduced in versions 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Injection vulnerability, with a CVSS Score of 7 and a CVSS Vector of...

7CVSS6.1AI score0.00181EPSS
SaveExploits0
IBM Security Bulletins
IBM Security Bulletins
added 2026/06/26 6:29 p.m.16 views

Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Denial of Service (Dos) attacks, and Incorrect Authorization attacks

Summary IBM Terracotta uses Spring Framework as an application foundation within the product. Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. By...

7.5CVSS5.9AI score0.0036EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/06/26 6:23 p.m.11 views

Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Cross-site Scripting attacks, Denial of Service (DoS) attacks, and Server-Side Request Forgery attacks

Summary IBM Terracotta uses Spring Framework as an application foundation within the product. Vulnerability Details CVEID:CVE-2026-41839 DESCRIPTION: A WebFlux application with a compromised subdomain for example, compromised via cross-site scripting XSS is vulnerable to an escalation attack...

7.1CVSS5.7AI score0.00267EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/06/26 6:21 p.m.15 views

Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Information Disclosure, Denial of Service (Dos) attacks, and Path Traversal attacks

Summary IBM Terracotta uses Spring Framework as an application foundation within the product. Vulnerability Details CVEID:CVE-2026-41841 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring...

7.5CVSS5.8AI score0.00399EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/06/26 6:09 p.m.9 views

Security Bulletin: IBM Terracotta is affected by multiple Spring Framework vulnerabilities that could allow exploiting WebSocket sessions and cross-site scripting

Summary IBM Terracotta uses Spring Framework as an application foundation within the product. Vulnerability Details CVEID:CVE-2026-41838 DESCRIPTION: IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination...

7.5CVSS5.5AI score0.00213EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/06/26 5:03 p.m.13 views

Security Bulletin: Vulnerabilities in Spring Security, Apache Tomcat, Netty, Lodash, Spring Framework and Node.js might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Spring Security, Apache Tomcat, Netty, Lodash, Spring Framework and Node.js. Vulnerabilities include the authentication, authorization, and other security controls being rendered inactive on intended requests,...

8.2CVSS7.3AI score0.01594EPSS
SaveExploits0Affected Software1
F5 Networks
F5 Networks
added 2026/06/26 3:52 p.m.11 views

K000161933: Spring Framework vulnerability CVE-2026-41853

Security Advisory Description Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48. CVE-2026-41853 Impact There is no impact; F5 products...

5.3CVSS5.8AI score0.00186EPSS
SaveExploits0
F5 Networks
F5 Networks
added 2026/06/26 3:49 p.m.10 views

K000161932: Spring Framework vulnerability CVE-2026-41842

Security Advisory Description Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48. CVE-2026-41842 Impact There...

7.5CVSS5.8AI score0.00399EPSS
SaveExploits0
F5 Networks
F5 Networks
added 2026/06/26 1:45 p.m.16 views

K000161931: Spring Framework vulnerability CVE-2026-41838

Security Advisory Description IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1....

7.5CVSS5.7AI score0.00171EPSS
SaveExploits0
F5 Networks
F5 Networks
added 2026/06/26 1:40 p.m.13 views

K000161930: Spring Framework vulnerability CVE-2026-41848

Security Advisory Description Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: matchString pattern, String path,...

7.5CVSS5.7AI score0.00317EPSS
SaveExploits0
Rows per page
Query Builder