Vulnerabilities in Spring
247 resultsCVE-2026-41695HIGHDenial of Service in Spring Data Commons Property Path ResolutionEPSS 0.4%CVE-2026-41716HIGHSpring Data web support unbounded negative-result cache keyed on attacker-supplied property namesEPSS 0.4%CVE-2026-59294MEDIUMArbitrary File Write via Path Traversal in ResourceCacheServiceEPSS 0.4%CVE-2026-22742HIGHServer-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL FetchingEPSS 0.4%CVE-2026-47841HIGHWebAuthn User Verification Bypass via Session SerializationEPSS 0.4%CVE-2026-41705HIGHSpring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs.
SprinEPSS 0.4%CVE-2026-47878MEDIUMUnsafe Java deserialization in DefaultExecutionContextSerializer without class allowlistEPSS 0.4%CVE-2026-41856HIGHSpring GraphQL Annotation Detection VulnerabilityEPSS 0.4%CVE-2026-40998HIGHJaxp13 XPath XXE via StreamSource and SAXSourceEPSS 0.4%CVE-2026-47849HIGHSpring Data REST allows mutation of identifier and version properties via JSON PatchEPSS 0.4%CVE-2026-59280MEDIUMSpring Framework Path Traversal via Backslash in SpringTemplateLoaderEPSS 0.3%CVE-2026-41732HIGHIn Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserializationEPSS 0.3%CVE-2026-22731HIGHAuthentication Bypass under Actuator Health groups pathsEPSS 0.3%CVE-2026-47852HIGHPredictable cache directory location allows local ONNX model substitution in Spring AIEPSS 0.3%CVE-2026-47834MEDIUMSpring Data JPA Sort expression validation bypassEPSS 0.3%CVE-2026-41841MEDIUMSpring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFluxEPSS 0.3%CVE-2026-40978HIGHSQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs.EPSS 0.3%CVE-2026-41848LOWSpring Framework Denial of Service via AntPathMatcherEPSS 0.3%CVE-2026-47858HIGHlive information startup mode is vulnerable for remote code executionEPSS 0.3%CVE-2026-59276MEDIUMTiming Attack via Non-Constant-Time Comparison of Sensitive ValuesEPSS 0.3%