20089 matches found
CVE-2026-41719: Improper Neutralization of Special Elements used in an Expression Language Statement
A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...
VMware Spring Data KeyValue and VMware Spring Data Redis security vulnerabilities
VMware Spring Data KeyValue and VMware Spring Data Redis are both products of the American company VMware. VMware Spring Data KeyValue is a key-value storage data access framework. VMware Spring Data Redis is a Redis data access framework. Both VMware Spring Data KeyValue and VMware Spring Data...
VMware Spring Data Commons security vulnerabilities
VMware Spring Data Commons is a data access abstraction framework developed by VMware, Inc. There is a security vulnerability in VMware Spring Data Commons. This vulnerability stems from the internal property lookup cache, which permanently retains strings provided by attackers as cache keys...
CVE-2026-41732: Deserialization of Untrusted Data
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...
Linux Distros Unpatched Vulnerability : CVE-2026-41854
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a...
Directory Traversal
Overview org.springframework.integration:spring-integration-ftp is a Affected versions of this package are vulnerable to Directory Traversal. via improper validation of file paths received from FTP, SFTP, or SMB servers. A malicious or compromised server can write arbitrary files outside the...
io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40995 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)
org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40995 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320712...
io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.9.0-alpha2) +7 more potentially affected by CVE-2026-40995 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.1.3)
org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40995 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320712...
Improper Validation of Certificate with Host Mismatch
Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch via missing hostname verification in the auto-configuration. An attacker can impersonate a trusted mail server and intercept or manipulate SMTP communications because hostname...
PT-2026-75974
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...
cve-2026-41700 - HIGH - Cross-Site WebSocket Hijacking in Spring for GraphQL
cve-2026-41700 - HIGH - Cross-Site WebSocket Hijacking in Spring for GraphQL...
cve-2026-40986 - MEDIUM - Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML
cve-2026-40986 - MEDIUM - Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML...
cve-2026-41856 - HIGH - Spring GraphQL Annotation Detection Vulnerability
cve-2026-41856 - HIGH - Spring GraphQL Annotation Detection Vulnerability...
cve-2026-40995 - MEDIUM - X.509 authentication bypasses Spring Security account checks
cve-2026-40995 - MEDIUM - X.509 authentication bypasses Spring Security account checks...
cve-2026-40987 - HIGH - Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization
cve-2026-40987 - HIGH - Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization...
cve-2026-40997 - MEDIUM - SOAP security faults leak Spring Security account state
cve-2026-40997 - MEDIUM - SOAP security faults leak Spring Security account state...
cve-2026-41699 - HIGH - Unsafe Deserialization in Spring GraphQL
cve-2026-41699 - HIGH - Unsafe Deserialization in Spring GraphQL...
cve-2026-40999 - HIGH - Spring WS SSRF via unvalidated WS-Addressing reply destinations
cve-2026-40999 - HIGH - Spring WS SSRF via unvalidated WS-Addressing reply destinations...