| CVE-2026-41847 |
Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL
|
4.8
Medium
|
Jun 9, 2026 |
| CVE-2026-41846 |
Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of…
|
5.9
Medium
|
Jun 9, 2026 |
| CVE-2026-41845 |
Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the…
|
7.1
High
|
Jun 9, 2026 |
| CVE-2026-41844 |
A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly…
|
4.2
Medium
|
Jun 9, 2026 |
| CVE-2026-41843 |
Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources
|
5.9
Medium
|
Jun 9, 2026 |
| CVE-2026-41842 |
Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources
|
7.5
High
|
Jun 9, 2026 |
| CVE-2026-41841 |
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources
|
5.9
Medium
|
Jun 9, 2026 |
| CVE-2026-41840 |
Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests
|
5.9
Medium
|
Jun 9, 2026 |
| CVE-2026-41839 |
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is…
|
4.2
Medium
|
Jun 9, 2026 |
| CVE-2026-41838 |
IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible…
|
4.8
Medium
|
Jun 9, 2026 |
| CVE-2026-22737 |
Use of Java scripting engine enabled (e.g
|
5.9
Medium
|
Mar 19, 2026 |
| CVE-2025-22233 |
CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and…
|
3.1
Low
|
May 16, 2025 |
| CVE-2024-38808 |
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a…
|
4.3
Medium
|
Aug 20, 2024 |
| CVE-2024-22262 |
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g
|
8.1
High
|
Apr 16, 2024 |
| CVE-2024-22259 |
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g
|
8.1
High
|
Mar 16, 2024 |
| CVE-2024-22243 |
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g
|
8.1
High
|
Feb 23, 2024 |
| CVE-2024-22233 |
In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that…
|
7.5
High
|
Jan 22, 2024 |
| CVE-2023-34053 |
In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that…
|
5.3
Medium
|
Nov 28, 2023 |
| CVE-2020-5397 |
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that…
|
5.3
Medium
|
Jan 17, 2020 |
| CVE-2020-5398 |
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to…
|
8.0
High
|
Jan 16, 2020 |