VMware Spring Integration 路径遍历漏洞

VMware Spring Integration is an enterprise application integration framework developed by VMware, Inc. Versions 7.0.0 to 7.0.4, 6.5.0 to 6.5.8, 6.4.0 to 6.4.11, 6.3.0 to 6.3.14, and 5.5.0 to 5.5.20 of VMware Spring Integration have a path traversal vulnerability. This vulnerability arises due to...

VMware Spring Web Flow 安全漏洞

VMware Spring Web Flow is a web application flow management framework developed by the American company VMware. Versions 4.0.0, 3.0.0 to 3.0.1, and 2.5.0 to 2.5.1 of VMware Spring Web Flow contain security vulnerabilities. These vulnerabilities stem from the possibility of malicious Unified EL...

Spring Boot: Spring Boot: Remote code execution via timing attack in DevTools remote secret comparison

A flaw was found in Spring Boot. An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about a remote secret. In extreme circumstances, this could allow the attacker to determine the secret and upload changed classes, leading to...

Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory

A flaw was found in Spring Boot. A local attacker on the same host as the application may be able to take control of the ApplicationTemp directory due to predictable temporary directory handling. When the server.servlet.session.persistent setting is enabled and the attack persists across...

Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path

A flaw was found in Spring Boot. This vulnerability, an authentication bypass, occurs when an application endpoint requiring authentication is declared under a specific path already configured for a Health Group additional path. A remote attacker could exploit this to bypass authentication,...

Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.

A flaw was found in Spring Boot. The $random.value property source utilizes a weak pseudo-random number generator PRNG, meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information...

Important: Red Hat Security Advisory: HawtIO 4.4.0 for Red Hat build of Apache Camel 4 Release and security update.

HawtIO 4.4.0 for Red Hat build of Apache Camel 4 GA Release is now available. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product Security has rated this update ...

CVE-2026-41840

Spring WebFlux applications are vulnerable to Denial of Service DoS attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview org.springframework.security:spring-security-saml2-service-provider is a security component for the Spring Framework. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the REDIRECT binding. An attacker can exhaust system...

Cross-site Scripting (XSS)

Overview org.springframework.security:spring-security-saml2-service-provider is a security component for the Spring Framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the RelyingPartyRegistration function. An attacker can execute arbitrary scripts in the...

Improper Certificate Validation

Overview org.springframework.amqp:spring-amqp is a package that provides support for using Spring and Java with AMQP 0.9.1, and in particular RabbitMQ. Affected versions of this package are vulnerable to Improper Certificate Validation. in the RabbitConnectionFactoryBean.setUri function when...

cn.aradin:aradin-spring-actuator-starter (>=1.1.0 <=1.1.2), cn.hdfk7.boot:hdfk7-boot-starter-common (>=1.0.0 <=3.0.3) +354 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-rabbit (>=3.0.0 <=3.2.10)

org.springframework.amqp:spring-rabbit MAVEN version =3.0.0, =1.1.0, =1.0.0, =3.1.0.5, =3.3.0.0, =1.0.0-JDK21, =0.1.0, =0.6.0, =0.6.0, =0.6.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-41714 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-17308787...

com.childrengreens:amqp-multi-source-spring-boot-starter (=3.0), com.i360day:spring-boot-starter-amqp-invoker (>=4.0.0 <=4.0.1) +69 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-rabbit (>=4.0.0-M1 <=4.0.3)

org.springframework.amqp:spring-rabbit MAVEN version =4.0.0-M1, =4.0.0, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =0.7.9, =0.7.9, =0.7.16 and more Source cves: CVE-2026-41714 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-17308787...

Allocation of Resources Without Limits or Throttling

Overview org.springframework.data:spring-data-commons is a maven plugin to centralize common resources and configuration for Spring Data Maven builds. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the property-lookup cache. An attacke...

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' via parameter binding when a repository query method is annotated with @Query and uses a capture-all placeholder. An...

ai.langsa:ccaas-starter (>=0.1 <=cloud-0.3), ai.langsa:pom-ccaas-langsa (=0.1) +2174 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.0.0 <=3.5.11)

org.springframework.data:spring-data-keyvalue MAVEN version =3.0.0, =0.1, =1.0.0-20260516144515, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.3, =2.0.0, =2.0.0, =2.0.0, =2.4.1 and more Source cves: CVE-2026-41719 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-17308644...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0 <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0 <=1.1.0) +401 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=4.0.0-M1 <=4.0.5)

org.springframework.data:spring-data-keyvalue MAVEN version =4.0.0-M1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =6.0.1, =4.0.0.0-M2, =4.0.0.0-M2, =4.0.0.0-M2, =4.0.0.0-M2, =4.0.0.0-M2, =4.0.0.0-M2, =4.0.0.0-M2, =4.0.0.0-M2, =4.0.0.0-M2, =4.0.0.0-M3 and more Source cves: CVE-2026-41719 Source advisory:...

com.childrengreens:amqp-multi-source-spring-boot-starter (=3.0), com.i360day:spring-boot-starter-amqp-invoker (>=4.0.0 <=4.0.1) +69 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-rabbit (>=4.0.0-M1 <=4.0.3)

org.springframework.amqp:spring-rabbit MAVEN version =4.0.0-M1, =4.0.0, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =0.7.9, =0.7.9, =0.7.16 and more Source cves: CVE-2026-41701 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-17308629...

cn.aradin:aradin-spring-actuator-starter (>=1.1.0 <=1.1.2), cn.hdfk7.boot:hdfk7-boot-starter-common (>=1.0.0 <=3.0.3) +354 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-rabbit (>=3.0.0 <=3.2.10)

org.springframework.amqp:spring-rabbit MAVEN version =3.0.0, =1.1.0, =1.0.0, =3.1.0.5, =3.3.0.0, =1.0.0-JDK21, =0.1.0, =0.6.0, =0.6.0, =0.6.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-41701 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-17308629...

Insecure Randomness

Overview Affected versions of this package are vulnerable to Insecure Randomness via the sendAndReceive function when using a fixed reply queue, due to correlation IDs being generated sequentially by an internal counter. An attacker can intercept or inject unauthorized replies by predicting...