Spring Security

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet contai…CVE-2022-22978Vmware · 12% likely

   CWE-863

2. Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the in…CVE-2021-22119Vmware · 6.0% likely

   CWE-400

3. Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a sec…CVE-2023-34034Vmware · CVSS 9.1 · 4.1% likely

   CWE-281

4. Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with t…CVE-2022-22976Vmware · 2.3% likely

   CWE-190

5. Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A mal…CVE-2022-31690Vmware · CVSS 8.1 · 1.3% likely
6. Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses request…CVE-2023-34035Vmware · CVSS 7.3 · 0.7% likely

   CWE-863

7. In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security contex…CVE-2023-20862Vmware · CVSS 6.3 · 0.6% likely

   CWE-459

8. Under Some Conditions Spring Security HTTP Headers Are not WrittenCVE-2026-22732VMware · CVSS 9.1 · 0.5% likelycovered by CyberSIXT

   CWE-425

9. CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized typesCVE-2025-41248VMware · CVSS 7.5 · 0.4% likely

   CWE-289

10. The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file sy…CVE-2023-34042Vmware · CVSS 4.1 · 0.2% likely

    CWE-732

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.