10268 matches found
Deserialization of Untrusted Data
Overview com.alibaba:fastjson is a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the JSON parsing path in JSON.parse, JSON.parseObjectString, and JSON.parseObjectString, Class when it runs inside a Spring Boot...
Vulnerabilities found in Oracle Financial Services
Oracle has identified vulnerabilities in various Financial Services modules. Oracle has also processed updates for various third-party products. The vulnerabilities include code injection through malicious schemes in Apache Avro, unauthorized access to sensitive data in various Oracle products, a...
Security Bulletin: IBM Sterling Connect:Direct Web Services is Vulnerable to Regular Expression Denial of Service (ReDoS)
Summary spring-core-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41848. Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which is then...
Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.
Summary spring-expression-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...
Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.
Summary spring-webmvc-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846. Vulnerability Details CVEID:CVE-2026-41841 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Information Disclosure...
opentaint analyzer/2026.07.22.49c8792
The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dan...
CLEANSTART-2026-ZG11653 Security fixes for ghsa-4265-ccf5-phj5, ghsa-4g9r-vxhx-9pgx applied in versions: 3.4.13-r0
Multiple security vulnerabilities affect the spring-boot package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-JI44198 Security fixes for ghsa-j288-q9x7-2f5v applied in versions: 3.5.13-r0
Security vulnerability affects the spring-boot package. This issue is resolved in later releases. See references for vulnerability details...
Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.
Summary spring-web-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854. Vulnerability Details CVEID:CVE-2026-41839 DESCRIPTION: A WebFlux application with a compromised subdomain for example, compromised via...
fastjson-1.2.83-rce
Fastjson 1.2.83 RCE Vulnerability Testing Environment Vuln...
PT-2026-66792
Multiple security vulnerabilities affect the spring-boot package. These issues are resolved in later releases. See references for individual vulnerability details...
PT-2026-66787
Security vulnerability affects the spring-boot package. This issue is resolved in later releases. See references for vulnerability details...
This Week in Spring - July 21st, 2026
Welcome to another installment of This Week in Spring! I'm writing this while enjoying a cup of coffee from the Caribbean on a little PTO. How're you doin'? Whenever I go on PTO, I like to sit by some body of water with a coffee and a laptop nearby. I alternate between plunges in the ocean and...
Improper Isolation or Compartmentalization
Overview Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization due to the GroovySandboxScriptEngineImpl implementation in the core/spring module. An administrator with the entitlements to manage Implementations can supply a malicious Groovy class that...
CVE-2026-41855
A flaw was found in Spring Framework. In an untrusted Java Message Service JMS environment, the MappingJackson2MessageConverter and JacksonJsonMessageConverter components allow for arbitrary class instantiation. This vulnerability can be exploited by a remote attacker through gadget class...
CVE-2026-41849
A flaw was found in the Spring Expression Language SpEL within the Spring Framework. An integer overflow vulnerability allows a remote attacker to supply a specially crafted SpEL expression. This can trigger excessive resource consumption, leading to a Denial of Service DoS condition. Mitigation...
K000162344: Spring framework vulnerability CVE-2026-41003
Security Advisory Description An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through...
K000162341: Multiple Spring framework vulnerabilities
Security Advisory Description CVE-2026-41837 Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19;...