org.springframework.integration:spring-integration-ftp (>=7.1.0-M1 <=7.1.0-RC1), org.springframework.integration:spring-integration-sftp (>=7.1.0-M1 <=7.1.0-RC1) +2 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=7.1.0-M1 <=7.1.0-RC1)

org.springframework.integration:spring-integration-file MAVEN version =7.1.0-M1, =7.1.0-M1, =7.1.0-M1, =7.1.0-M1, =7.1.0-M1, =7.1.0-RC1 Source cves: CVE-2026-40987 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-17308053...

VMware Spring Data Commons 资源管理错误漏洞

VMware Spring Data Commons is a data access abstraction framework developed by VMware Corporation. There is a resource management vulnerability in VMware Spring Data Commons, which may lead to a StackOverflowException during the parsing of Sort parameters, resulting in a denial-of-service attack...

com.apollographql.federation:federation-spring-subscription-callback (>=5.0.0 <=6.1.0), com.graphql-java-generator.graphql-gradle-plugin3:com.graphql-java-generator.graphql-gradle-plugin3.gradle.plugin (>=4.0 <=4.0.2) +45 more potentially affected by CVE-2026-41699 via org.springframework.graphql:spring-graphql (>=2.0.0-M1 <=2.0.3)

org.springframework.graphql:spring-graphql MAVEN version =2.0.0-M1, =5.0.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0.2 - com.introproventures:graphql-jpa-query-test-boot-starter =1.4.0 - com.introproventures:graphql-jpa-query-test-multiple-datasources =1.4.0 -...

VMware Spring Data REST 安全漏洞

VMware Spring Data REST is a data interface provided by the American company VMware. It is used to build HTTP resources that drive hypermedia, based on Spring Data repositories. These resources are designed to manage domain models of applications and provide hypermedia-driven services for...

VMware Spring Data Commons 资源管理错误漏洞

VMware Spring Data Commons is a data access abstraction framework developed by VMware Corporation in the United States. Vulnerabilities exist in versions 4.0.0 and earlier, as well as versions 3.5.0 and earlier, 3.4.0 and earlier, 3.3.0 and earlier, 3.2.0 and earlier, 3.1.0 and earlier, 3.0.0 and...

VMware Spring AMQP 信任管理问题漏洞

VMware Spring AMQP is a message queue integration framework developed by VMware, Inc. There is a vulnerability related to trust management in VMware Spring AMQP. This vulnerability arises when configuring a proxy connection using RabbitConnectionFactoryBean.setUriamqps://…, without calling...

Spring Security 授权问题漏洞

Spring Security is a security framework developed by Spring OpenSource that includes authentication and authorization features. Vulnerabilities related to authorization exist in versions 5.7.0 to 5.7.24, 5.8.0 to 5.8.26, 6.3.0 to 6.3.17, 6.4.0 to 6.4.17, and 6.5.0 to 6.5.10 of Spring Security...

VMware Spring Data KeyValue和VMware Spring Data Redis 安全漏洞

VMware Spring Data KeyValue and VMware Spring Data Redis are both products of the American company VMware. VMware Spring Data KeyValue is a key-value storage data access framework. VMware Spring Data Redis is a Redis data access framework. Both VMware Spring Data KeyValue and VMware Spring Data...

Spring Security 加密问题漏洞

Spring Security is a security framework developed by Spring OpenSource that includes authentication and authorization features. Spring Security has a data manipulation vulnerability, which stems from SAML decryption of SAML responses, as well as SAML logout requests and logout responses whose...

VMware Spring Data Relational 安全漏洞

VMware Spring Data Relational is a relational database access framework developed by VMware, Inc. There is a security vulnerability in VMware Spring Data Relational, which stems from the improper escaping of external control inputs when using StringMatcher in Query By Example. Attackers can use...

cn.herodotus.engine:message-sdk-mqtt (>=3.1.5.6 <=3.5.5.2), cn.herodotus.engine:message-spring-boot-starter (>=3.1.5.6 <=3.5.5.2) +70 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=6.0.0 <=6.5.8)

org.springframework.integration:spring-integration-file MAVEN version =6.0.0, =3.1.5.6, =3.1.5.6, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =1.0.0, =1.5.0, =1.4.0, =1.0, =1.0.0, =2.0.0-milestone-03, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-11 and more Source cves: CVE-2026-40987ht...

cve-2026-41856 - HIGH - Spring GraphQL Annotation Detection Vulnerability

cve-2026-41856 - HIGH - Spring GraphQL Annotation Detection Vulnerability...

cve-2026-40985 - MEDIUM - Data Binding Vulnerability in Spring Web Flow with Unified EL Parser

cve-2026-40985 - MEDIUM - Data Binding Vulnerability in Spring Web Flow with Unified EL Parser...

cve-2026-40992 - MEDIUM - Mail Auto-Configuration Does Not Enable SSL Hostname Verification

cve-2026-40992 - MEDIUM - Mail Auto-Configuration Does Not Enable SSL Hostname Verification...

cve-2026-40986 - MEDIUM - Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

cve-2026-40986 - MEDIUM - Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML...

VMware Spring Data Commons 资源管理错误漏洞

VMware Spring Data Commons is a data access abstraction framework developed by VMware Corporation in the United States. There is a resource management vulnerability in VMware Spring Data Commons. This vulnerability arises when the attribute path string controlled by the attacker is passed to the...

Improper Validation of Certificate with Host Mismatch

Overview org.springframework.boot:spring-boot-mail is a Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch. via missing hostname verification in the auto-configuration. An attacker can impersonate a trusted mail server and intercept or...

Replay Attack

Overview Affected versions of this package are vulnerable to Replay Attack due to the Wss4jSecurityInterceptor class in Wss4jSecurityInterceptor.java not consistently wiring configured Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, replay protections...

Directory Traversal

Overview org.springframework.integration:spring-integration-file is a Spring Integration File Support Affected versions of this package are vulnerable to Directory Traversal via improper validation of file paths received from FTP, SFTP, or SMB servers. A malicious or compromised server can write...

VMware Spring Data REST 安全漏洞

VMware Spring Data REST is a data interface provided by the American company VMware. It is used to build HTTP resources that drive hypermedia, based on Spring Data repositories. These resources are designed to manage domain models of applications and provide hypermedia-driven services for...