Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.

A flaw was found in Spring Boot. The $random.value property source utilizes a weak pseudo-random number generator PRNG, meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information...

CLSA-2026-1789999868 TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.1.8-tuxcare.1...

CLSA-2026-1789999145 TuxCare security update for org.springframework.data:spring-data-commons (3 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 3 CVEs. Fixed in 3.2.12-tuxcare.1...

CLSA-2026-1789995986 TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 3.4.13-tuxcare.1...

CVE-2026-59305

A flaw was found in Spring Cloud Stream. A partition interceptor may be improperly added when messages are sent. This could lead to unexpected behavior or incorrect message processing within the application, potentially affecting message routing or data integrity. Mitigation Mitigation for this...

CVE-2026-59306

A flaw was found in Spring Cloud Stream. This vulnerability involves the potential for deserialization of untrusted data. An attacker with high privileges and user interaction could exploit this to potentially impact the confidentiality and integrity of data. Mitigation To mitigate this issue,...

CVE-2026-59303

A flaw was found in Spring Cloud Stream where the dynamic destination cache size is not properly bound. This could lead to excessive memory consumption, potentially impacting system resources. An attacker with high privileges and user interaction could exploit this vulnerability over a network to...

CVE-2026-59302

A flaw was found in Spring Cloud Stream. This vulnerability could lead to the logging of sensitive data, potentially exposing confidential information. While the exact trigger is not specified, the issue allows for unintended data exposure within application logs. This could result in a low impac...

CVE-2026-47894

A flaw was found in Spring Cloud Config Server. This vulnerability allows for the exposure of configuration files outside of their intended repository path. An attacker with high privileges could exploit this flaw through the native environment repository, leading to sensitive information...

CVE-2026-47836

A flaw was found in Spring Cloud Config Server. The base directory used by the server to clone SVN repositories is susceptible to a Time-of-Check Time-of-Use TOCTOU attack. A local attacker with high privileges could exploit this vulnerability by manipulating the directory between the security...

ROOT-APP-MAVEN-CVE-2025-41248 CVE-2025-41248 in org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2025-41248 in the org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22732 CVE-2026-22732 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2026-22732 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

CVE-2026-59283

A flaw was found in Spring Framework. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. This could allow an attacker to circumvent security restrictions,...

CVE-2026-47886

A flaw was found in Spring Framework. Applications that process user-supplied Spring Expression Language SpEL expressions are vulnerable to a Denial of Service DoS attack. This occurs when the power operator ^ is used with large numerical operands, leading to excessive resource consumption. A...

CVE-2026-47888

A flaw was found in Spring Framework, specifically within Spring RSocket applications. A remote attacker could exploit this vulnerability by sending a malformed SETUP frame to an affected application. This could lead to a memory leak, potentially causing a denial of service. Mitigation Disable...

Cross-site Scripting (XSS)

Spring Authorization Server is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to user-controlled values being rendered without HTML entity encoding in the default consent page, which allows an attacker to inject malicious content through a crafted OAuth2 authorization request an...

Exposure Of Sensitive Information Through Log Files

Spring Cloud Stream is vulnerable to Exposure of Sensitive Information Through Log Files. The vulnerability is due to sensitive data potentially being included in application logs, which allows an attacker with access to the log files to obtain sensitive information...

ROOT-APP-MAVEN-CVE-2025-41232 CVE-2025-41232 in org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2025-41232 in the org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

CLEANSTART-2026-YX18209 Security fix for CVE-2026-22745 applied in: activemq 5.19.8-r3, activemq 6.1.8-r1, activemq 6.2.3-r1, apache-hive 4.1.0-r5, apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, kafka-ui 1.4.2-r6, spring-boot 3.4.13-r3

CVE-2026-22745 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FB65905 Security fix for CVE-2026-54428 applied in: apache-nifi 2.10.0-r2, apache-nifi 2.6.0-r3, cassandra-reaper-fips 4.0.2-r3, cassandra-reaper-fips 4.1.1-r2, elasticsearch 9.2.8-r0, elasticsearch 9.3.5-r2, elasticsearch 9.3.7-r1, elasticsearch 9.3.8-r1, elasticsearch 9.4.3-r1, elasticsearch 9.4.4-r4, sonarqube 26.3.0.120487-r4, spring-boot 3.4.13-r3, spring-boot 4.0.7-r0, spring-boot 4.1.0-r0

CVE-2026-54428 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...