Vulnerabilidades em spring
247 resultadosAnálise Vexday
Spring apresenta 1 CVE na base Vexday, sem ocorrências de ataque ativo documentado (KEV). A vulnerabilidade é relacionada a falha em autenticação (CWE-287) e não foi publicada nos últimos 90 dias, indicando risco estável e consolidado.
CVE-2026-40988HIGHUnbounded DEFLATE Inflation in SAML 2.0 Service ProviderEPSS 0.3%CVE-2026-47879HIGHSpring Cloud Gateway SSRF and native file access with gRPCEPSS 0.3%CVE-2026-41721MEDIUMSpring Data Commons Denial of Service via Data BindingEPSS 0.3%CVE-2026-41855HIGHSpring Framework Unsafe Deserialization via Jackson JMS ConvertersEPSS 0.3%CVE-2026-41717HIGHSpring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter BindingEPSS 0.3%CVE-2026-59286HIGHSpring for GraphQL loads Untrusted Resources in GraphiQL supportEPSS 0.3%CVE-2026-47861MEDIUMUDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=falseEPSS 0.3%CVE-2026-59271MEDIUMAdmin password disclosed in BrokerNotAliveException messageEPSS 0.3%CVE-2025-22232MEDIUMSpring Cloud Config Server May Not Use Vault Token Sent By ClientsEPSS 0.3%CVE-2026-59316HIGHSpring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)EPSS 0.3%CVE-2026-47856MEDIUMJsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-listEPSS 0.3%CVE-2026-40975MEDIUMValues produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} shoEPSS 0.3%CVE-2026-47850MEDIUMSpring Data REST allows mutation of the version property of immutable aggregates via PUTEPSS 0.3%CVE-2026-41728HIGHSpring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collectionsEPSS 0.3%CVE-2026-47835HIGHSpring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector StoresEPSS 0.3%CVE-2026-41711MEDIUMPotential Denial of Service through crafted Sort ParametersEPSS 0.3%CVE-2026-59319MEDIUMRediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data ExposureEPSS 0.3%CVE-2026-59296MEDIUMMicrometer StatsD and Logging meter registries line-protocol and log injection vulnerabilityEPSS 0.3%CVE-2026-41007HIGHSpring HATEOAS heap exhaustion through unbounded internal cachingEPSS 0.3%CVE-2026-47862MEDIUMZipTransformer uses file_name header to build workDirectory path without sanitizationEPSS 0.3%