2837 matches found
ch.admin.bit.jeap:jeap-oauth-mock-server (>=4.0.0-alpha-springboot4, <=5.3.1), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=4.0.0-alpha-springboot4, <=5.3.1) +74 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.6)
org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =3.6.0, =3.5.0, =5.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =2.0.1 -...
Assignment to Variable without Use
Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...
Improper Verification Of Cryptographic Signature
Spring Security is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to SAML Responses and LogoutRequest/LogoutResponse elements being decrypted without requiring a valid signature, which allows an attacker to craft malicious SAML payloads and use the Servic...
K000162929: Spring Security Authorization Server vulnerability CVE-2026-41008
Security Advisory Description Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can...
Open Redirect
Spring Security is vulnerable to Open Redirect. The vulnerability is due to CookieRequestCache and CookieServerRequestCache storing and using an unvalidated absolute URL from a browser cookie as the post-login redirect target, allowing an attacker to redirect users to a malicious destination...
Deserialization Of Untrusted Data
Spring Security is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to malicious serialized payloads being stored in verificationcredentials or encryptioncredentials by an attacker with write access to the saml2assertingpartymetadata table managed by...
Denial Of Service
Spring Security is vulnerable to Denial Of Service. The vulnerability is due to an unbounded writer inflating compressed SAML payloads into memory when processing SAML 2.0 Login or Logout requests using the REDIRECT binding, allowing an attacker to exhaust application memory...
Cross Site Scripting
Spring Security is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to attacker-controlled values in RelyingPartyRegistration being rendered in HTML forms generated by Spring Security filters, allowing arbitrary code execution in the context of the application...
CLSA-2026-1786563390 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 19 org.springframework.security packages to address 1 CVE. Fixed in 6.2.7-tuxcare.3...
K000162895: Spring Framework CookieRequestCache vulnerability CVE-2026-41706
Security Advisory Description Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is...
CLSA-2026-1786479067 TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 21 org.springframework.security packages to address 4 CVEs. Fixed in 5.6.10-tuxcare.7...
CLSA-2026-1785965552 TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 21 org.springframework.security packages to address 4 CVEs. Fixed in 5.7.14-tuxcare.4...
Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.
Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in July 2026. Vulnerability Details CVEID:CVE-2026-40984 DESCRIPTION: In Micrometer, it is possible for a user to provid...
CLSA-2026-1785814692 TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 18 org.springframework.security packages to address 3 CVEs. Fixed in 6.0.8-tuxcare.1...
CLSA-2026-1785814923 TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 19 org.springframework.security packages to address 2 CVEs. Fixed in 6.2.7-tuxcare.1...
CLSA-2026-1785814912 TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 19 org.springframework.security packages to address 2 CVEs. Fixed in 6.2.8-tuxcare.1...
CLSA-2026-1785727931 TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 21 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.12-tuxcare.6...
CLSA-2026-1785291983 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 19 org.springframework.security packages to address 1 CVE. Fixed in 6.4.3-tuxcare.7...