Input Validation and Logic

Every one of the 12 is a mark on the map. Named now: 1 to 12, most at risk first.

1. Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposedCVE-2025-22235Spring · CVSS 7.3 · 0.4% likely

   CWE-20

2. Spring Framework DataBinder Case Sensitive Match ExceptionCVE-2025-22233Spring · CVSS 3.1 · 0.4% likely

   CWE-20

3. In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loopCVE-2026-59317Spring · CVSS 6.5 · 0.4% likely

   CWE-1284

4. Spring LDAP sensitive data exposure for case-sensitive comparisonsCVE-2024-38829Spring · CVSS 3.7 · 0.4% likely

   CWE-178

5. EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeadersCVE-2026-59322Spring · CVSS 6.3 · 0.3% likely

   CWE-20

6. DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant namesCVE-2026-47880Spring · CVSS 5.4 · 0.3% likely

   CWE-20

7. Reactor Netty may incorrectly route traffic due to DNS resolver reuseCVE-2026-47843Spring · CVSS 3.7 · 0.3% likely

   CWE-706

8. In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behaviorCVE-2026-41727Spring · CVSS 6.5 · 0.2% likely

   CWE-20

9. SMB minimum protocol dialect defaults to SMB1CVE-2026-59293Spring · CVSS 6.6 · 0.2% likely

   CWE-757

10. Potential for improper filtering of HTTP headers in Spring Cloud FunctionCVE-2026-59298Spring · CVSS 3.1 · 0.2% likely

    CWE-20

11. Partition interceptor may be improperly added while sending messageCVE-2026-59305Spring · CVSS 3.1 · 0.2% likely

    CWE-696

12. Potential Security Misconfiguration when Using withIssuerLocationCVE-2026-22748Spring · CVSS 5.3 · 0.2% likely

    CWE-20

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.