Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
22971
Total
1632
Critical
7220
High
7324
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-41978 | MEDIUM | 4.4 | Permission control vulnerability in the clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Jun 09, 2026 |
| CVE-2026-41975 | MEDIUM | 6.3 | Permission management vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affect service integrity. | Jun 09, 2026 |
| CVE-2026-41855 | HIGH | 8.1 | In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affected versions: Spring … | Jun 09, 2026 |
| CVE-2026-41854 | MEDIUM | 4.2 | Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side … | Jun 09, 2026 |
| CVE-2026-41853 | MEDIUM | 5.3 | Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; … | Jun 09, 2026 |
| CVE-2026-41852 | LOW | 3.7 | A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an … | Jun 09, 2026 |
| CVE-2026-41851 | MEDIUM | 5.3 | Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL … | Jun 09, 2026 |
| CVE-2026-41850 | HIGH | 7.5 | Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an … | Jun 09, 2026 |
| CVE-2026-41849 | HIGH | 7.5 | An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted … | Jun 09, 2026 |
| CVE-2026-41848 | LOW | 3.7 | Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then … | Jun 09, 2026 |
| CVE-2026-41847 | MEDIUM | 4.8 | Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48. | Jun 09, 2026 |
| CVE-2026-41846 | MEDIUM | 5.9 | Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript code injection, potentially resulting … | Jun 09, 2026 |
| CVE-2026-41845 | HIGH | 7.1 | Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability. … | Jun 09, 2026 |
| CVE-2026-41844 | MEDIUM | 4.2 | A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to … | Jun 09, 2026 |
| CVE-2026-41843 | MEDIUM | 5.9 | Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; … | Jun 09, 2026 |
| CVE-2026-41842 | HIGH | 7.5 | Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 … | Jun 09, 2026 |
| CVE-2026-41841 | MEDIUM | 5.9 | Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; … | Jun 09, 2026 |
| CVE-2026-41840 | MEDIUM | 5.9 | Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; … | Jun 09, 2026 |
| CVE-2026-41839 | MEDIUM | 4.2 | A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID … | Jun 09, 2026 |
| CVE-2026-41838 | MEDIUM | 4.8 | IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected … | Jun 09, 2026 |
| CVE-2026-41720 | HIGH | 7.4 | Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring … | Jun 09, 2026 |
| CVE-2026-41715 | MEDIUM | 6.1 | In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this … | Jun 09, 2026 |
| CVE-2026-41710 | MEDIUM | 5.9 | An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the … | Jun 09, 2026 |
| CVE-2026-41007 | HIGH | 7.5 | Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 … | Jun 09, 2026 |
| CVE-2026-41006 | HIGH | 7.5 | Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations. … | Jun 09, 2026 |