| CVE-2026-41001 |
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's…
|
5.3
Moyenne
|
11 juin 2026 |
| CVE-2026-40992 |
Spring Boot's Mail auto-configuration does not enable hostname verification
|
5.0
Moyenne
|
11 juin 2026 |
| CVE-2026-40977 |
When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID…
|
4.7
Moyenne
|
27 avr. 2026 |
| CVE-2026-40976 |
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all…
|
9.1
Critique
|
27 avr. 2026 |
| CVE-2026-40975 |
Values produced by ${random.value} are not suitable for use as secrets
|
4.8
Moyenne
|
27 avr. 2026 |
| CVE-2026-40974 |
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to…
|
5.0
Moyenne
|
27 avr. 2026 |
| CVE-2026-40973 |
A local attacker on the same host as the application may be able to take control of the directory used by…
|
7.0
Élevée
|
27 avr. 2026 |
| CVE-2026-40972 |
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information…
|
7.5
Élevée
|
27 avr. 2026 |
| CVE-2026-40971 |
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification…
|
5.0
Moyenne
|
27 avr. 2026 |
| CVE-2026-40970 |
When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname…
|
5.0
Moyenne
|
27 avr. 2026 |
| CVE-2026-22731 |
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application…
|
8.2
Élevée
|
19 mars 2026 |
| CVE-2025-22235 |
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been…
|
7.3
Élevée
|
28 avr. 2025 |
| CVE-2024-38807 |
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature…
|
6.3
Moyenne
|
23 août 2024 |
| CVE-2023-34055 |
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially…
|
5.3
Moyenne
|
28 nov. 2023 |
| CVE-2019-3797 |
This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19
|
3.5
Faible
|
6 mai 2019 |