Race Conditions

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunctionCVE-2026-59324Spring · CVSS 8.2 · 0.3% likelycovered by CyberSIXT

   CWE-3621 article

2. The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCT…CVE-2026-41002Spring · CVSS 7.4 · 0.2% likely

   CWE-367

3. Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVNCVE-2026-47836Spring · CVSS 7.2 · 0.2% likely

   CWE-367

4. Shared JSR-223 ScriptEngine evaluated concurrently without THREADING checkCVE-2026-59321Spring · CVSS 4.2 · 0.2% likely

   CWE-362

5. Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessionsCVE-2026-22751Spring · CVSS 4.8 · 0.1% likely

   CWE-367

6. Server Sent Event stream corruptionCVE-2026-22735Spring · CVSS 2.6 · 0.1% likely

   CWE-667

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.