2110 matches found
cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces...
cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification
cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification...
cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3), cn.herodotus.dante:dante-authorization-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +38 more potentially affected by CVE-2026-47841 via org.springframework.security:spring-security-webauthn (>=7.0.0, <=7.0.6)
org.springframework.security:spring-security-webauthn MAVEN version =7.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.2.0-m4, =4.0.2.0-m4, =4.0.0.0-m4, =4.0.0.0-m4, =4.1.0.0-m1 and more Sourc...
cn.herodotus.dante:dante-authentication-autoconfigure (4.1.0.1), cn.herodotus.dante:dante-authorization-autoconfigure (4.1.0.1) +38 more potentially affected by CVE-2026-47841 via org.springframework.security:spring-security-webauthn (7.1.0)
org.springframework.security:spring-security-webauthn MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-webauthn and may be impacted: - cn.herodotus.dante:dante-authentication-autoconfigure...
ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +12081 more potentially affected by CVE-2026-47842 via org.springframework.security:spring-security-crypto (>=5.7.0, <=7.0.6)
org.springframework.security:spring-security-crypto MAVEN version =5.7.0, =0.2.0, =0.5.0, =0.6.0, =0.5.0, =0.8.4, =0.8.4, =0.9.1, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.9.2 and more Source cves: CVE-2026-47842 Source advisory:...
com.erudika:para-server (>=1.55.0, <=1.55.2), com.kerb4j:kerb4j-server-spring-security-ldap (>=0.5.0, <=0.5.1) +17 more potentially affected by CVE-2026-59270 via org.springframework.security:spring-security-ldap (7.1.0)
org.springframework.security:spring-security-ldap MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-ldap and may be impacted: - com.erudika:para-server =1.55.0, =0.5.0, =7.0.1, =7.0.1,...
Binding to an Unrestricted IP Address
Overview org.springframework.security:spring-security-ldap is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Binding to an...
Comparison of Object References Instead of Object Contents
Overview Affected versions of this package are vulnerable to Comparison of Object References Instead of Object Contents in the process of comparing UserVerificationRequirement during WebAuthn authentication, when using distributed HTTP session stores. An attacker can bypass user verification by...
Generation of Predictable IV with CBC Mode
Overview org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Generation of Predictable IV with CBC Mode via AesBytesEncryptor when using the two-argument constructor or specifying a null I...
Assignment to Variable without Use
Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...
Access Control Bypass
Overview org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Access Control Bypass in the InetAddressMatchers process. An attacker can bypass network-based access control...
Replay Attack
Overview org.springframework.security:spring-security-oauth2-jose is a provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Replay Attack through the DPoPProofJwtDecoderFactory. An attacker can gain unauthorized access and impersonate a victim...
Timing Attack
Overview org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Timing Attack via the comparison of sensitive values using standard string equality rather than constant-time...
Improper Verification Of Cryptographic Signature
Spring Security is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to SAML Responses and LogoutRequest/LogoutResponse elements being decrypted without requiring a valid signature, which allows an attacker to craft malicious SAML payloads and use the Servic...
K000162929: Spring Security Authorization Server vulnerability CVE-2026-41008
Security Advisory Description Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can...
Open Redirect
Spring Security is vulnerable to Open Redirect. The vulnerability is due to CookieRequestCache and CookieServerRequestCache storing and using an unvalidated absolute URL from a browser cookie as the post-login redirect target, allowing an attacker to redirect users to a malicious destination...
Deserialization Of Untrusted Data
Spring Security is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to malicious serialized payloads being stored in verificationcredentials or encryptioncredentials by an attacker with write access to the saml2assertingpartymetadata table managed by...
Denial Of Service
Spring Security is vulnerable to Denial Of Service. The vulnerability is due to an unbounded writer inflating compressed SAML payloads into memory when processing SAML 2.0 Login or Logout requests using the REDIRECT binding, allowing an attacker to exhaust application memory...
Cross Site Scripting
Spring Security is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to attacker-controlled values in RelyingPartyRegistration being rendered in HTML forms generated by Spring Security filters, allowing arbitrary code execution in the context of the application...
