9898 matches found
Path Traversal
Spring AI is vulnerable to Path Traversal. The vulnerability is due to ResourceCacheService.getCacheName appending an unvalidated URI fragment to the cache filename, allowing path separators or .. sequences to escape the intended resourceParentFolder when writing downloaded files...
CVE-2026-59276
Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...
CVE-2026-59277
Spring Security InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. In Spring Security 7.1.0, the internal address classification did...
CLSA-2026-1788349534 TuxCare security update for org.springframework (7 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 7 CVEs. Fixed in 5.3.27-tuxcare.9...
CLSA-2026-1788349330 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.29-tuxcare.9...
CLSA-2026-1788348838 TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 2.7.18-tuxcare.8...
CLSA-2026-1788346056 TuxCare security update for org.springframework (23 CVEs)
TuxCare rebuilt 25 org.springframework packages to address 23 CVEs. Fixed in 6.0.11-tuxcare.1...
CLSA-2026-1788344824 TuxCare security update for org.springframework (27 CVEs)
TuxCare rebuilt 25 org.springframework packages to address 27 CVEs. Fixed in 6.0.13-tuxcare.1...
CLSA-2026-1788342506 TuxCare security update for org.springframework (11 CVEs)
TuxCare rebuilt 25 org.springframework packages to address 11 CVEs. Fixed in 6.0.16-tuxcare.6...
CLSA-2026-1788341776 TuxCare security update for org.springframework (14 CVEs)
TuxCare rebuilt 21 org.springframework packages to address 14 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.4...
Cleartext Storage Of Sensitive Information
Spring AMQP is vulnerable to Cleartext Storage of Sensitive Information. The vulnerability is due to the configured admin password being embedded in cleartext in the exception message when the RabbitMQ management aliveness check fails...
CLSA-2026-1788340622 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.30-tuxcare.9...
CLSA-2026-1788340467 TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 19 org.springframework.security packages to address 2 CVEs. Fixed in 6.1.6-tuxcare.6...
Improper Authorization
Spring AI is vulnerable to Improper Authorization. The vulnerability is due to per-request tool restrictions not being fully enforced during tool-call dispatch, allowing a tool unavailable to the current request to be invoked and potentially enabling privilege escalation...
CLSA-2026-1788333969 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 19 org.springframework.security packages to address 1 CVE. Fixed in 6.4.13-tuxcare.4...
Spring Security CVE-2026-22732 Detection / Remediation Tool
This OpenRewrite tool detects Java projects susceptible to CVE-2026-22732 in Spring Security and provides automated remediation recipes. It identifies affected Spring Security versions and response handling patterns that can cause security headers to be omitted, and can remediate affected project...
CLSA-2026-1788287051 TuxCare security update for org.springframework (24 CVEs)
TuxCare rebuilt 25 org.springframework packages to address 24 CVEs. Fixed in 6.1.13-tuxcare.2...
CLSA-2026-1788283253 TuxCare security update for org.springframework (20 CVEs)
TuxCare rebuilt 25 org.springframework packages to address 20 CVEs. Fixed in 6.1.19-tuxcare.3...