Security Bulletin: Multiple security vulnerabilites identified in open source libraries shipped with IBM Guardium Cryptography Manager (GCM)

Summary The vulnerabilities were found in dependent open source libraries used within IBM Guardium Cryptography Manager code base. These issues have been addressed by updating the versions of affected libraries. Vulnerability Details CVEID:CVE-2026-47838 DESCRIPTION: SubjectDnX509PrincipalExtract...

Exploit for CVE-2026-47851

Spring AI PDF Reader — sibling self-loop PoC incomplete fix o...

Security Bulletin: Multiple security vulnerabilities identified in Spring Framework version shipped with IBM Guardium Cryptography Manager (GCM)

Summary Security vulnerabilities identified in Spring Framework shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-41841 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static...

CVE-2026-59355

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to...

CVE-2026-59354

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

CVE-2026-59354

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

CLSA-2026-1787823679 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 2 CVEs. Fixed in 5.3.39-tuxcare.20...

CLSA-2026-1787820941 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.31-tuxcare.12...

CVE-2026-59355 Spring Authorization Server: Open Redirect via request_uri parameter

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to...

CVE-2026-59355 Spring Authorization Server: Open Redirect via request_uri parameter

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to...

EUVD-2026-66978

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to...

CVE-2026-59355

Spring Authorization Server versions 1.5.0 through 1.5.7 are affected by an open redirect vulnerability in the authorization endpoint . The root cause is insufficient validation of the request_uri parameter : an attacker can craft a request containing an invalid request_uri paired with an unvalid...

CVE-2026-59355

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to...

CVE-2026-59355 Spring Authorization Server: Open Redirect via request_uri parameter

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to...

EUVD-2026-66977

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

CVE-2026-59354

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

CVE-2026-59354 Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

CVE-2026-59354 Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

GHSA-9QF2-26P9-2Q2Q Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...