Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Spring Framework
HIGH 7.5
Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then dir…
Spring Framework
MEDIUM 6.1
A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to…
Spring Framework
MEDIUM 6.1
Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting …
Spring Framework
MEDIUM 6.1
Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTM…
Spring Framework
MEDIUM 5.9
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Fram…
Spring Framework
MEDIUM 5.9
Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.…
Spring Framework
MEDIUM 5.3
Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 throu…
Spring Hateoas
HIGH 7.5
Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HAT…
Spring Framework
HIGH 7.5
IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination wi…
Spring Framework
MEDIUM 5.9
Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework…
Spring Hateoas
HIGH 7.5
Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs be…
Aria Operations
HIGH 8.0
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies…
Aria Operations
MEDIUM 5.4
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies…
Aria Operations
MEDIUM 5.4
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies…
Spring Cloud Function
MEDIUM 6.5
Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.…
Spring Cloud Function
MEDIUM 6.5
OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud…
Spring Ai
MEDIUM 6.5
Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could all…
Fusion
HIGH 7.0
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious a…
Spring Ai
HIGH 8.2
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using …
Spring Ai
HIGH 7.5
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure betw…
Spring Ai
HIGH 8.6
Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.…
Spring Cloud Config
HIGH 8.1
The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to t…
Spring Cloud Config
CRITICAL 9.1
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or …
Spring Cloud Config
HIGH 7.5
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially expos…
Spring Framework
MEDIUM 6.5
A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files ma…
Spring Framework
MEDIUM 5.3
Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application can…
Spring Grpc
HIGH 8.8
When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherit…
Spring Grpc
MEDIUM 5.3
The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This al…
Spring Ai
HIGH 8.8
SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs. Affecte…
Spring Ai
MEDIUM 6.5
In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextSt…