| CVE-2026-59277 |
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing…
|
3.7
Low
|
Aug 27, 2026 |
| CVE-2026-59276 |
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals())…
|
5.9
Medium
|
Aug 27, 2026 |
| CVE-2026-59270 |
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative…
|
9.4
Critical
|
Aug 27, 2026 |
| CVE-2026-47877 |
Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding
|
8.2
High
|
Aug 27, 2026 |
| CVE-2026-47842 |
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as…
|
6.5
Medium
|
Aug 26, 2026 |
| CVE-2026-47841 |
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a…
|
7.4
High
|
Aug 26, 2026 |
| CVE-2026-41707 |
Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's…
|
7.4
High
|
Aug 25, 2026 |
| CVE-2026-47838 |
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can…
|
6.8
Medium
|
Jun 9, 2026 |
| CVE-2026-41706 |
Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a…
|
6.1
Medium
|
Jun 9, 2026 |
| CVE-2026-41694 |
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses…
|
3.7
Low
|
Jun 9, 2026 |
| CVE-2026-41008 |
Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri…
|
6.1
Medium
|
Jun 9, 2026 |
| CVE-2026-41003 |
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms…
|
7.6
High
|
Jun 9, 2026 |
| CVE-2026-40993 |
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository…
|
7.3
High
|
Jun 9, 2026 |
| CVE-2026-40988 |
An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be…
|
7.5
High
|
Jun 9, 2026 |
| CVE-2026-22754 |
Vulnerability in Spring Spring Security
|
7.5
High
|
Apr 22, 2026 |
| CVE-2026-22753 |
Vulnerability in Spring Spring Security
|
7.5
High
|
Apr 22, 2026 |
| CVE-2026-22748 |
Vulnerability in Spring Spring Security
|
5.3
Medium
|
Apr 22, 2026 |
| CVE-2026-22747 |
Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509…
|
6.8
Medium
|
Apr 22, 2026 |
| CVE-2026-22746 |
Vulnerability in Spring Spring Security
|
3.7
Low
|
Apr 22, 2026 |
| CVE-2026-22751 |
Vulnerability in Spring Spring Security
|
4.8
Medium
|
Apr 21, 2026 |
| CVE-2026-22733 |
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application…
|
8.2
High
|
Mar 19, 2026 |
| CVE-2025-22234 |
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in…
|
5.3
Medium
|
Jan 22, 2026 |
| CVE-2025-41232 |
Spring Security Aspects may not correctly locate method security annotations on private methods
|
9.1
Critical
|
May 21, 2025 |
| CVE-2025-22223 |
Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods
|
5.3
Medium
|
Mar 24, 2025 |
| CVE-2025-22228 |
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72…
|
7.4
High
|
Mar 20, 2025 |