Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Vcenter Server
CRITICAL 9.8
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this i…
Spring Ai
HIGH 7.5
In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire Ve…
Spring For Graphql
CRITICAL 9.8
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious…
Spring For Graphql
HIGH 8.1
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an …
Spring For Graphql
HIGH 7.5
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarch…
Spring Security
HIGH 8.1
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value fo…
Spring Data Rest
HIGH 8.1
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) req…
Spring For Apache Kafka
HIGH 8.1
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that tr…
Spring For Apache Pulsar
HIGH 8.1
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all o…
Spring Data Rest
HIGH 7.5
Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when …
Spring For Apache Kafka
MEDIUM 6.5
When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spr…
Spring For Apache Kafka
MEDIUM 6.5
Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a …
Spring Data Rest
MEDIUM 5.3
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP …
Spring Data Rest
MEDIUM 5.3
Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson cu…
Spring Data Mongodb
HIGH 8.1
Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a…
Spring Security
MEDIUM 6.1
Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be r…
Spring Security
HIGH 7.2
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able…
Spring Security
MEDIUM 6.1
Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a …
Spring Data Mongodb
MEDIUM 5.9
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound para…
Spring Security
MEDIUM 5.4
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters…
Spring Security
MEDIUM 5.3
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature…
Spring Security
HIGH 7.5
An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of se…
Spring Framework
CRITICAL 9.8
In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.conver…
Spring Framework
HIGH 7.5
An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying …
Spring Framework
HIGH 7.5
Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By p…
Spring Framework
HIGH 7.5
Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the ev…
Spring Framework
MEDIUM 6.5
Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed …
Spring Framework
MEDIUM 5.3
A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or…
Spring Framework
MEDIUM 5.3
Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; …
Spring Framework
HIGH 7.5
Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: Spring Fra…