9263 matches found
ROOT-APP-MAVEN-CVE-2024-38808 CVE-2024-38808 in org.springframework:spring-expression - Patched by Root
Root has patched CVE-2024-38808 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2024-38809 CVE-2024-38809 in org.springframework:spring-web - Patched by Root
Root has patched CVE-2024-38809 in the org.springframework:spring-web package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2023-20861 CVE-2023-20861 in org.springframework:spring-expression - Patched by Root
Root has patched CVE-2023-20861 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2025-41242 CVE-2025-41242 in org.springframework:spring-webmvc - Patched by Root
Root has patched CVE-2025-41242 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-AIKIDO-2026-61483 AIKIDO-2026-61483 in org.springframework.security:spring-security-oauth2-jose - Patched by Root
Root has patched AIKIDO-2026-61483 in the org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-22739 CVE-2026-22739 in org.springframework.cloud:spring-cloud-config-server - Patched by Root
Root has patched CVE-2026-22739 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-41002 CVE-2026-41002 in org.springframework.cloud:spring-cloud-config-server - Patched by Root
Root has patched CVE-2026-41002 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-40981 CVE-2026-40981 in org.springframework.cloud:spring-cloud-config-server - Patched by Root
Root has patched CVE-2026-40981 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...
CVE-2026-21876
CVE-2026-21876 bypass del WAF de OWASP CRS Contenedor Docker de CVE-2026-21876 + PoC mínimo. Quiero agradecer por separado a @airween y a @fzipi por su rápida respuesta. La corrección de la vulnerabilidad estuvo lista en muy poco tiempo. PoC Ejecutar: cd springbootundertowstand or aspnetstand...
CLEANSTART-2026-SR72438 application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2
Security vulnerability affects the apache-nifi package. An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2...
CLEANSTART-2026-UC97457 Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics
Security vulnerability affects the apache-nifi package. The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics...
CVE-2022-22965-Spring4Shell-Security-Operations-Analysis
CVE-2022-22965 — Análisis de Operaciones de Seguridad de Spring4Shell Una simulación práctica de un Centro de Operaciones de Seguridad SOC donde desempeñé el rol de Analista de Seguridad de la Información respondiendo a un intento activo de explotación de Spring4Shell. Este repositorio documenta ...
Spring Framework 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 SSE Stream Corruption
The version of Spring Framework installed on the remote host is 5.3.x prior to 5.3.50, 6.0.x prior to 6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by a vulnerability: - Spring MVC applications using the functional web framework are...
Spring Security 6.5.x < 6.5.12 / 7.0.x < 7.0.6.1 / 7.1.x < 7.1.0.1 DPoP Proof Replay
The version of Spring Security installed on the remote host is 6.5.x prior to 6.5.12, 7.0.x prior to 7.0.6.1, or 7.1.x prior to 7.1.0.1. It is, therefore, affected by a vulnerability: - Spring Security's DPoPProofJwtDecoderFactory uses an internal cache to store the processed jti JWT ID claims,...
Spring Framework < 5.2.26 / 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Response Splitting
The version of Spring Framework installed on the remote host is prior to 5.2.26, 5.3.x prior to 5.3.50, 6.0.x prior to 6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by a vulnerability: - Applications that build a Content-Disposition...
ROOT-APP-MAVEN-CVE-2025-41254 CVE-2025-41254 in org.springframework:spring-websocket - Patched by Root
Root has patched CVE-2025-41254 in the org.springframework:spring-websocket package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-22740 CVE-2026-22740 in org.springframework:spring-webflux - Patched by Root
Root has patched CVE-2026-22740 in the org.springframework:spring-webflux package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2025-41234 CVE-2025-41234 in org.springframework:spring-web - Patched by Root
Root has patched CVE-2025-41234 in the org.springframework:spring-web package for Root:Maven. Multiple fixed versions available...
netty-resolver-dns-check
netty-resolver-dns-check Offline checker for three DNS cache poisoning CVEs in io.netty:netty-resolver-dns — CVE-2026-45674 , CVE-2026-47691 and CVE-2026-45673 — and for the question the version number cannot answer: is your application actually using that resolver? If you use Spring WebClient, t...