10025 matches found
CVE-2026-41840
A flaw was found in Spring WebFlux applications. A remote attacker could exploit this vulnerability by sending specially crafted multipart requests, leading to a Denial of Service DoS condition. This could make the application unavailable to legitimate users. Mitigation No specific mitigation is...
CLSA-2026-1787661459 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.12-tuxcare.8...
CLSA-2026-1787649513 TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 18 org.springframework.security packages to address 2 CVEs. Fixed in 6.0.8-tuxcare.2...
CVE-2026-51368: Deserialization of Untrusted Data
An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code via a crafted request to the console/heimdall endpoint...
CVE-2026-51368
An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code via a crafted request to the console/heimdall endpoint...
CVE-2026-41707: Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...
This Week in Spring - August 25th, 2026
Hi, Spring fans! Welcome back to another installment of This Week in Spring. It’s a big week ahead: I’m about to head out on a packed tour through Europe—Wrocław for a friend’s wedding, Oslo for JavaZone, Paris for a Spring meetup details coming soon, Amsterdam for IntelliJ IDEA conf—and then on ...
PT-2026-81899
Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Description An authentication bypass issue exists in the DPoPProofJwtDecoderFactory due to a cache-based replay attack. Th...
K000163050: Spring REST Docs vulnerability CVE-2026-40991
Security Advisory Description When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the...
K000163049: Spring Data Commons vulnerability CVE-2026-41695
Security Advisory Description Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0...
K000163048: Spring web services vulnerability CVE-2026-40998
Security Advisory Description Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that...
CVE-2014-0225
CVE-2014-0225...
CVE-2026-59317
CVE-2026-59317...
CVE-2026-59322
CVE-2026-59322...
CVE-2026-59320
CVE-2026-59320...
CVE-2026-41848
CVE-2026-41848...
CVE-2026-41847
CVE-2026-41847...
CVE-2026-41846
CVE-2026-41846...