Spring · weakness class
Information Disclosure
17 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 17 is a mark on the map. Named now: 1 to 17, most at risk first.
- Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService
- Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation
- Spring for GraphQL Information Exposure in GraphiQL support
- SOAP security faults leak Spring Security account state
- Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux
- Timing Attack via Non-Constant-Time Comparison of Sensitive Values
- Admin password disclosed in BrokerNotAliveException message
- An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this cou…
- Reactor Netty WebSocket Client Leaks Credentials On Redirect
- Potential for logging sensitive data in Spring Cloud Stream
- Potential for logging sensitive data in Spring Cloud Function Azure
- User Attribute Enumeration when Using DaoAuthenticationProvider
- Potential for logging sensitive data in Spring Cloud Function AWS
- Spring gRPC AuthenticationException message reflected to remote client
- Spring Data REST exposes persistence-layer internals in error responses
- When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13…
- HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.