Spring Spring Security

• CVE-2026-59277 Low 3.7 Spring Security InetAddressMatchers Incomplete Internal Network Classification 0.3%
• CVE-2026-59276 Medium 5.9 Timing Attack via Non-Constant-Time Comparison of Sensitive Values 0.3%
• CVE-2026-59270 Critical 9.4 Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces 0.4%
• CVE-2026-47877 High 8.2 Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) 0.3%
• CVE-2026-47842 Medium 6.5 Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation 0.1%
• CVE-2026-47841 High 7.4 WebAuthn User Verification Bypass via Session Serialization 0.4%
• CVE-2026-41707 High 7.4 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay 0.4%
• CVE-2026-47838 Medium 6.8 Unauthorized User Impersonation when Using X.509 Client Certificates 0.1%
• CVE-2026-41706 Medium 6.1 Open Redirect When Using CookieRequestCache 0.2%
• CVE-2026-41694 Low 3.7 SAML Payloads Decrypted Without Valid Signature 0.1%
• CVE-2026-41008 Medium 6.1 Spring Security Authorization Server Open Redirect via request_uri 0.2%
• CVE-2026-41003 High 7.6 Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting 0.2%
• CVE-2026-40993 High 7.3 Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry 0.2%
• CVE-2026-40988 High 7.5 Unbounded DEFLATE Inflation in SAML 2.0 Service Provider 0.3%
• CVE-2026-22754 High 7.5 ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules 0.3%
• CVE-2026-22753 High 7.5 Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers 0.2%
• CVE-2026-22748 Medium 5.3 Potential Security Misconfiguration when Using withIssuerLocation 0.2%
• CVE-2026-22747 Medium 6.8 Unauthorized User Impersonation when Using X.509 Client Certificates 0.2%
• CVE-2026-22746 Low 3.7 User Attribute Enumeration when Using DaoAuthenticationProvider 0.2%
• CVE-2026-22751 Medium 4.8 Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions 0.1%
• CVE-2026-22733 High 8.2 Authentication Bypass under Actuator CloudFoundry endpoints 0.4%
• CVE-2025-22234 Medium 5.3 Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation 0.4%
• CVE-2025-41232 Critical 9.1 CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods 0.6%
• CVE-2025-22223 Medium 5.3 Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass.  You are not affected if you are not usin 0.5%
• CVE-2025-22228 High 7.4 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length 0.6%
• CVE-2024-38810 Medium 6.5 Missing Authorization When Using @AuthorizeReturnObject 0.5%
• CVE-2024-22234 High 7.4 CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated 0.7%