| CVE-2026-59314 |
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response…
|
3.7
Faible
|
27 août 2026 |
| CVE-2026-59313 |
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent…
|
9.8
Critique
|
27 août 2026 |
| CVE-2026-59283 |
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable…
|
9.1
Critique
|
27 août 2026 |
| CVE-2026-59282 |
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a…
|
7.5
Élevée
|
27 août 2026 |
| CVE-2026-59281 |
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then…
|
6.1
Moyenne
|
27 août 2026 |
| CVE-2026-59280 |
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a…
|
4.3
Moyenne
|
27 août 2026 |
| CVE-2026-47893 |
A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by…
|
7.5
Élevée
|
27 août 2026 |
| CVE-2026-47892 |
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header…
|
9.8
Critique
|
27 août 2026 |
| CVE-2026-47891 |
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the…
|
9.8
Critique
|
27 août 2026 |
| CVE-2026-47890 |
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view…
|
9.8
Critique
|
27 août 2026 |
| CVE-2026-47889 |
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite…
|
7.5
Élevée
|
27 août 2026 |
| CVE-2026-47888 |
A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame
|
7.5
Élevée
|
27 août 2026 |
| CVE-2026-47887 |
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a…
|
6.1
Moyenne
|
27 août 2026 |
| CVE-2026-47886 |
Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial…
|
7.5
Élevée
|
27 août 2026 |
| CVE-2026-47885 |
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to…
|
7.5
Élevée
|
27 août 2026 |
| CVE-2026-47883 |
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns
|
6.1
Moyenne
|
27 août 2026 |
| CVE-2026-47884 |
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping…
|
9.8
Critique
|
27 août 2026 |
| CVE-2026-41855 |
In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and…
|
8.1
Élevée
|
9 juin 2026 |
| CVE-2026-41854 |
Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally…
|
4.2
Moyenne
|
9 juin 2026 |
| CVE-2026-41853 |
Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks
|
5.3
Moyenne
|
9 juin 2026 |
| CVE-2026-41852 |
A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method…
|
3.7
Faible
|
9 juin 2026 |
| CVE-2026-41851 |
Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of…
|
5.3
Moyenne
|
9 juin 2026 |
| CVE-2026-41850 |
Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an…
|
7.5
Élevée
|
9 juin 2026 |
| CVE-2026-41849 |
An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL)
|
7.5
Élevée
|
9 juin 2026 |
| CVE-2026-41848 |
Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to…
|
3.7
Faible
|
9 juin 2026 |