Spring Spring Cloud Config

• CVE-2026-59315 Medium 5.3 Spring Cloud Config Monitor Denial of Service 0.4%
• CVE-2026-47894 Medium 4.9 Spring Cloud Config Server Native Environment Repository Exposure 0.5%
• CVE-2026-47837 Medium 6.8 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests 0.6%
• CVE-2026-47836 High 7.2 Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN 0.2%
• CVE-2026-40981 High 7.5 When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cl 0.4%
• CVE-2026-41002 High 7.4 The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring C 0.2%
• CVE-2026-41004 Medium 4.4 When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade 0.2%
• CVE-2026-40982 Critical 9.1 Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially craf 0.7%
• CVE-2025-22232 Medium 5.3 Spring Cloud Config Server May Not Use Vault Token Sent By Clients 0.3%