Complete feed
No mitigation yet
No fix, workaround or mitigation extracted yet
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-41006] Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type…
Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.
High [CVE-2026-40983] In Micrometer, it is possible for a user to provide specially crafted gRPC requests
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.
Medium [CVE-2026-41854] Spring Framework: Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally pro…
Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.
Medium [CVE-2026-41853] Spring Framework: Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.
Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Medium [CVE-2026-41851] Spring Framework: Applications which accept user-supplied Spring Expression Language (SpEL) expressions
Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth. Affected product named by the advisory: Spring Framework.
Medium [CVE-2026-41847] Spring Framework: Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.
Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected product named by the advisory: Spring Framework.
Medium [CVE-2026-41846] Spring Framework: Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags
Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript code injection, potentially resulting in a cross-site scripting (XSS) vulnerability. Affected product named by the advisory: Spring Framework.
Medium [CVE-2026-41844] Spring Framework: Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified
A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix. Affected product named by the advisory: Spring Framework.
Medium [CVE-2026-41843] Spring Framework: Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.
Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected product named by the advisory: Spring Framework.
Medium [CVE-2026-41841] Spring Framework: Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected product named by the advisory: Spring Framework.
Medium [CVE-2026-41840] Spring Framework: Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.
Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.
Medium [CVE-2026-41839] Spring Framework: WebFlux application with a compromised subdomain (for example, compromised
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected product named by the advisory: Spring Framework.
Medium [CVE-2026-41838] Spring Framework: IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which
IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected product named by the advisory: Spring Framework.
Medium [CVE-2026-41715] In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client
In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
Medium [CVE-2026-41710] attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide…
An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.
Low [CVE-2026-41852] Spring Framework: vulnerability in Spring Expression Language (SpEL) evaluation logic
A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic. Affected product named by the advisory: Spring Framework.
Low [CVE-2026-41848] Spring Framework: Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a…
Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path). Affected product named by the advisory: Spring Framework.
High [CVE-2026-41724] VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with…
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
High [CVE-2026-41860] BOSH: CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM.
CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH director or UAA and steal credentials.
Medium [CVE-2026-41704] BOSH: AgentClient#handle_method (lines 264-303) processes every NATS reply.
AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response['value']['result']['compile_log_id'] (line 332-338) and passes it to download_and_delete_blob. Separately, any response containing 'exception' goes through format_exception (lines 308-325), which reads exception['blobstore_id'] and also calls download_and_delete_blob. That helper (lines 344-349) calls ResourceManager#get_resource(blob_id) and, in an ensure block, ResourceManager#delete_resource(blob_id). ResourceManager (resource_manager.rb:62-70) calls blobstore.delete(id) on the single shared Director blobstore with no UUID-format check, no ownership check, and no namespace prefix. Affected product named by the advisory: BOSH.