Spring Spring Web Flow

• CVE-2026-40986 Medium 4.8 Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML 0.2%
• CVE-2026-40985 Medium 6.4 Data Binding Vulnerability in Spring Web Flow with Unified EL Parser 0.2%