1048 matches found
cve-2026-59278 - MEDIUM - In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages
cve-2026-59278 - MEDIUM - In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages...
cve-2026-47856 - MEDIUM - JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list
cve-2026-47856 - MEDIUM - JsonToObjectTransformer resolves the jsonTypeId message header to an arbitrary class without an allow-list...
cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay...
cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation
cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation...
cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests...
cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT
cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT...
cve-2026-47843 - LOW - Reactor Netty may incorrectly route traffic due to DNS resolver reuse
cve-2026-47843 - LOW - Reactor Netty may incorrectly route traffic due to DNS resolver reuse...
cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader...
cve-2026-47857 - MEDIUM - Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
cve-2026-47857 - MEDIUM - Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around...
cve-2026-47861 - MEDIUM - UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false
cve-2026-47861 - MEDIUM - UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false...
cve-2026-47881 - MEDIUM - Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
cve-2026-47881 - MEDIUM - Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File...
cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist
cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist...
cve-2026-47883 - MEDIUM - Spring Framework Open Redirect in UrlHandlerFilter
cve-2026-47883 - MEDIUM - Spring Framework Open Redirect in UrlHandlerFilter...
cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler...
cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse...
cve-2026-47892 - MEDIUM - Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
cve-2026-47892 - MEDIUM - Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints...
cve-2026-47890 - LOW - Spring Framework Server Sent Event stream corruption while rendering fragments
cve-2026-47890 - LOW - Spring Framework Server Sent Event stream corruption while rendering fragments...
cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader
cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader...
cve-2026-59279 - HIGH - Unbounded persistent session allocation via repeated initialize requests
cve-2026-59279 - HIGH - Unbounded persistent session allocation via repeated initialize requests...
cve-2026-59274 - MEDIUM - Unbounded decompression in UnZipTransformer enables zip-bomb DoS
cve-2026-59274 - MEDIUM - Unbounded decompression in UnZipTransformer enables zip-bomb DoS...
cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization
cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization...
cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch
cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch...
cve-2026-47859 - MEDIUM - Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
cve-2026-47859 - MEDIUM - Unbounded memory allocation in RFC6587SyslogDeserializer octet-counted framing — remote DoS...
cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush
cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush...
cve-2026-47860 - MEDIUM - Unbounded decompression of attacker-supplied compressed message bodies
cve-2026-47860 - MEDIUM - Unbounded decompression of attacker-supplied compressed message bodies...
cve-2026-47877 - HIGH - Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
cve-2026-47877 - HIGH - Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting XSS...
cve-2026-59272 - MEDIUM - Log4j2 AmqpAppender disables TLS hostname verification by default
cve-2026-59272 - MEDIUM - Log4j2 AmqpAppender disables TLS hostname verification by default...
cve-2026-59276 - MEDIUM - Timing Attack via Non-Constant-Time Comparison of Sensitive Values
cve-2026-59276 - MEDIUM - Timing Attack via Non-Constant-Time Comparison of Sensitive Values...
cve-2026-47852 - HIGH - Predictable cache directory location allows local ONNX model substitution in Spring AI
cve-2026-47852 - HIGH - Predictable cache directory location allows local ONNX model substitution in Spring AI...
cve-2026-47862 - MEDIUM - ZipTransformer uses file_name header to build workDirectory path without sanitization
cve-2026-47862 - MEDIUM - ZipTransformer uses filename header to build workDirectory path without sanitization...
cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests
cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests...
cve-2026-47884 - MEDIUM - Spring Framework Improper Path Limitation in XsltView
cve-2026-47884 - MEDIUM - Spring Framework Improper Path Limitation in XsltView...
cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader...
cve-2026-59275 - MEDIUM - Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)
cve-2026-59275 - MEDIUM - Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit99...
cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint
cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint...
cve-2026-59293 - MEDIUM - SMB minimum protocol dialect defaults to SMB1
cve-2026-59293 - MEDIUM - SMB minimum protocol dialect defaults to SMB1...
cve-2026-59282 - MEDIUM - Spring Framework Denial of Service via Unbounded List Growth in Data Binding
cve-2026-59282 - MEDIUM - Spring Framework Denial of Service via Unbounded List Growth in Data Binding...
cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names
cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names...
cve-2026-59311 - MEDIUM - Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
cve-2026-59311 - MEDIUM - Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation...
cve-2026-59283 - MEDIUM - Spring Framework Safety Guard Bypass via SpEL Expression Compilation
cve-2026-59283 - MEDIUM - Spring Framework Safety Guard Bypass via SpEL Expression Compilation...
cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN...
cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass
cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass...
cve-2026-47845 - MEDIUM - Reactor Netty HTTP Server may incorrectly evaluate proxy addresses
cve-2026-47845 - MEDIUM - Reactor Netty HTTP Server may incorrectly evaluate proxy addresses...
cve-2026-47848 - MEDIUM - Reactor Netty WebSocket Client Leaks Credentials On Redirect
cve-2026-47848 - MEDIUM - Reactor Netty WebSocket Client Leaks Credentials On Redirect...
cve-2026-47844 - MEDIUM - Reactor Netty HTTP Server Leaks Exception Details
cve-2026-47844 - MEDIUM - Reactor Netty HTTP Server Leaks Exception Details...
cve-2026-47879 - HIGH - Spring Cloud Gateway SSRF and native file access with gRPC
cve-2026-47879 - HIGH - Spring Cloud Gateway SSRF and native file access with gRPC...
cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist...
cve-2026-47886 - MEDIUM - Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions
cve-2026-47886 - MEDIUM - Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions...