Vendor
Spring
- CVEs tracked · all time
- 21
- in CISA KEV · all time
- 0
- articles · since 11 Sep
- 0
- articles · all time
- 10
No articles in the last 45 daysThe latest: SecurityWeek, Mon 24 Aug, 12:16 UTC.See the full timeline
Products: Spring AI, Spring Data Commons, Spring Data MongoDB, Spring Data REST and 7 more
Spring AISpring Data CommonsSpring Data MongoDBSpring Data RESTSpring for GraphQLSpring FrameworkSpring HATEOASSpring IntegrationSpring LDAPSpring SecuritySpring Web Services
CVEs
21 CVEsCVE-2026-59270Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfacesCVSS9.4Critical–Not in KEV0.4%EPSS2articles
CVE-2026-59318DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt InjectionCVSS6.5Medium–Not in KEV0.3%EPSS1article
CVE-2026-59279Unbounded persistent session allocation via repeated initialize requestsCVSS7.5High–Not in KEV0.6%EPSS1article
CVE-2026-47849Spring Data REST allows mutation of identifier and version properties via JSON PatchCVSS7.1High–Not in KEV0.3%EPSS1article
CVE-2026-59285Spring for GraphQL Unsafe Deserialization in pagination supportCVSS8.1High–Not in KEV0.4%EPSS2articles
CVE-2026-59324fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunctionCVSS8.2High–Not in KEV0.3%EPSS1article
CVE-2026-59307Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale referenceCVSS8.0High–Not in KEV0.4%EPSS1article
CVE-2026-40999Spring WS SSRF via unvalidated WS-Addressing reply destinationsCVSS8.6High–Not in KEV0.4%EPSS1article
CVE-2026-41003Unencoded HTML Outputs in Spring Security May Allow Cross-Site ScriptingCVSS7.6High–Not in KEV0.2%EPSS1article
9 more CVEs
CVE-2026-41700Cross-Site WebSocket Hijacking in Spring for GraphQLCVSS8.1High–Not in KEV0.2%EPSS1article
CVE-2026-41856Spring GraphQL Annotation Detection VulnerabilityCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-41729Spring Data REST SpEL Injection via Map Key in JSON PatchCVSS8.1High–Not in KEV0.4%EPSS1article
CVE-2026-41717Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter BindingCVSS8.1High–Not in KEV0.4%EPSS1article
CVE-2026-41716Spring Data web support unbounded negative-result cache keyed on attacker-supplied property namesCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-41842Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFluxCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-41720Authentication Bypass with Empty Password in Spring LDAPCVSS7.4High–Not in KEV0.3%EPSS1article
- Spring patches 91 bugs, fixing critical LDAP flaw CVE-2026-59270SecurityWeek
- VMware fixes high severity Spring flaws after August 2026 alertSecurityOnline
- Spring Security Bug CVE-2026-59270 Leaves LDAP Open to AttackSecurityOnline
- CVE-2026-59285 lets attackers run code via VMware Spring GraphQLSecurityOnline
- Spring Integration Vulnerabilities Demand Immediate ActionSecurityOnline
- Spring Framework Patches Critical Flaws, Urges Immediate UpgradeSecurityOnline
- Spring HATEOAS bugs let attackers bypass checks, crash serversSecurityOnline
- Spring GraphQL patches address CVE-2026-41699 deserialization riskSecurityOnline
- Critical Spring Data bugs expose systems to remote code executionSecurityOnline
- Spring Framework flaws allow LDAP bypass and DoS on Java cloudsSecurityOnline · first in our coverage