Vulnerabilidades em Spring

247 resultados
Análise Vexday

O ecossistema Spring acumula 149 CVEs catalogadas, com um volume expressivo de 98 vulnerabilidades surgidas nos últimos 90 dias, o que indica ritmo elevado de descoberta recente e demanda atenção contínua no processo de atualização. A taxa de exploração ativa está abaixo da média geral do catálogo CISA KEV, com nenhuma CVE confirmada em uso por atores maliciosos no momento, embora a presença de 8 vulnerabilidades com PoC pública e 7 de severidade crítica represente superfície de risco relevante. O tipo de falha mais frequente é CWE-400 (consumo descontrolado de recursos), sugerindo que controles de limitação de entrada e de recursos devem ser priorizados nas revisões de configuração. A CVE mais perigosa identificada é CVE-2020-5398, com score EPSS de 0,88, indicando alta probabilidade estatística de exploração — ambientes que ainda não aplicaram a correção correspondente devem tratá-la com urgência.

CVE-2026-41695HIGHDenial of Service in Spring Data Commons Property Path ResolutionEPSS 0.4%CVE-2026-41716HIGHSpring Data web support unbounded negative-result cache keyed on attacker-supplied property namesEPSS 0.4%CVE-2026-59294MEDIUMArbitrary File Write via Path Traversal in ResourceCacheServiceEPSS 0.4%CVE-2026-22742HIGHServer-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL FetchingEPSS 0.4%CVE-2026-47841HIGHWebAuthn User Verification Bypass via Session SerializationEPSS 0.4%CVE-2026-41705HIGHSpring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. SprinEPSS 0.4%CVE-2026-47878MEDIUMUnsafe Java deserialization in DefaultExecutionContextSerializer without class allowlistEPSS 0.4%CVE-2026-41856HIGHSpring GraphQL Annotation Detection VulnerabilityEPSS 0.4%CVE-2026-40998HIGHJaxp13 XPath XXE via StreamSource and SAXSourceEPSS 0.4%CVE-2026-47849HIGHSpring Data REST allows mutation of identifier and version properties via JSON PatchEPSS 0.4%CVE-2026-59280MEDIUMSpring Framework Path Traversal via Backslash in SpringTemplateLoaderEPSS 0.3%CVE-2026-41732HIGHIn Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserializationEPSS 0.3%CVE-2026-22731HIGHAuthentication Bypass under Actuator Health groups pathsEPSS 0.3%CVE-2026-47852HIGHPredictable cache directory location allows local ONNX model substitution in Spring AIEPSS 0.3%CVE-2026-47834MEDIUMSpring Data JPA Sort expression validation bypassEPSS 0.3%CVE-2026-41841MEDIUMSpring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFluxEPSS 0.3%CVE-2026-40978HIGHSQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs.EPSS 0.3%CVE-2026-41848LOWSpring Framework Denial of Service via AntPathMatcherEPSS 0.3%CVE-2026-47858HIGHlive information startup mode is vulnerable for remote code executionEPSS 0.3%CVE-2026-59276MEDIUMTiming Attack via Non-Constant-Time Comparison of Sensitive ValuesEPSS 0.3%