Vulnerabilidades en spring
247 resultadosCVE-2026-59328MEDIUMCross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency TooltipsEPSS 0.2%CVE-2026-41004MEDIUMWhen enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs.
Spring Cloud Config 3.EPSS 0.2%CVE-2026-41847MEDIUMSpring Framework Security Filter Bypass in WebFlux Kotlin Router DSLEPSS 0.2%CVE-2026-41845HIGHSpring Framework Cross-site Scripting via JavaScriptUtilsEPSS 0.2%CVE-2026-40971MEDIUMWhen configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to thEPSS 0.2%CVE-2026-41846MEDIUMSpring Framework Cross-site Scripting via JSP Form TagsEPSS 0.2%CVE-2026-47842MEDIUMDeterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext CorrelationEPSS 0.1%CVE-2026-40995MEDIUMX.509 authentication bypasses Spring Security account checksEPSS 0.1%CVE-2026-41694LOWSAML Payloads Decrypted Without Valid SignatureEPSS 0.1%CVE-2026-59292LOWWorld-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)EPSS 0.1%CVE-2026-41844MEDIUMSpring Framework Open Redirect in Spring MVC and WebFluxEPSS 0.1%CVE-2026-40970MEDIUMWhen configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting EPSS 0.1%CVE-2026-40973HIGHA local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.seEPSS 0.1%CVE-2026-59326LOWHTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language ServerEPSS 0.1%CVE-2026-59297LOWSpring Cloud Function can incorrectly determine if URI is secureEPSS 0.1%CVE-2026-47838MEDIUMUnauthorized User Impersonation when Using X.509 Client CertificatesEPSS 0.1%CVE-2026-41714MEDIUMIn Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManagerEPSS 0.1%CVE-2026-40996MEDIUMInbound WS-Security allows RSA PKCS#1 v1.5 key transport by defaultEPSS 0.1%CVE-2026-22751MEDIUMSpring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessionsEPSS 0.1%CVE-2026-40992MEDIUMMail Auto-Configuration Does Not Enable SSL Hostname VerificationEPSS 0.1%