| CVE-2026-59277 |
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing…
|
3.7
Faible
|
27 août 2026 |
| CVE-2026-59276 |
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals())…
|
5.9
Moyenne
|
27 août 2026 |
| CVE-2026-59270 |
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative…
|
9.4
Critique
|
27 août 2026 |
| CVE-2026-47877 |
Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding
|
8.2
Élevée
|
27 août 2026 |
| CVE-2026-47842 |
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as…
|
6.5
Moyenne
|
26 août 2026 |
| CVE-2026-47841 |
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a…
|
7.4
Élevée
|
26 août 2026 |
| CVE-2026-41707 |
Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's…
|
7.4
Élevée
|
25 août 2026 |
| CVE-2026-47838 |
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can…
|
6.8
Moyenne
|
9 juin 2026 |
| CVE-2026-41706 |
Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a…
|
6.1
Moyenne
|
9 juin 2026 |
| CVE-2026-41694 |
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses…
|
3.7
Faible
|
9 juin 2026 |
| CVE-2026-41008 |
Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri…
|
6.1
Moyenne
|
9 juin 2026 |
| CVE-2026-41003 |
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms…
|
7.6
Élevée
|
9 juin 2026 |
| CVE-2026-40993 |
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository…
|
7.3
Élevée
|
9 juin 2026 |
| CVE-2026-40988 |
An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be…
|
7.5
Élevée
|
9 juin 2026 |
| CVE-2026-22754 |
Vulnerability in Spring Spring Security
|
7.5
Élevée
|
22 avr. 2026 |
| CVE-2026-22753 |
Vulnerability in Spring Spring Security
|
7.5
Élevée
|
22 avr. 2026 |
| CVE-2026-22748 |
Vulnerability in Spring Spring Security
|
5.3
Moyenne
|
22 avr. 2026 |
| CVE-2026-22747 |
Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509…
|
6.8
Moyenne
|
22 avr. 2026 |
| CVE-2026-22746 |
Vulnerability in Spring Spring Security
|
3.7
Faible
|
22 avr. 2026 |
| CVE-2026-22751 |
Vulnerability in Spring Spring Security
|
4.8
Moyenne
|
21 avr. 2026 |
| CVE-2026-22733 |
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application…
|
8.2
Élevée
|
19 mars 2026 |
| CVE-2025-22234 |
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in…
|
5.3
Moyenne
|
22 janv. 2026 |
| CVE-2025-41232 |
Spring Security Aspects may not correctly locate method security annotations on private methods
|
9.1
Critique
|
21 mai 2025 |
| CVE-2025-22223 |
Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods
|
5.3
Moyenne
|
24 mars 2025 |
| CVE-2025-22228 |
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72…
|
7.4
Élevée
|
20 mars 2025 |