Vulnerabilities
Aggregated CVE / GHSA / KEV / OSV — filter by tag and category.
| ID | Title | |
|---|---|---|
| CVE-2026-47838 |
|
Authentication Bypass in org.springframework.security:spring-security-web (CVE-2026-47838)
authentication bypass in org.springframework.security:spring-security-web (CVE-2026-47838). Confidential information can be exposed externally. Exploitable via ``SubjectDnX509PrincipalExtractor``.
|
| CVE-2026-41003 |
|
Cross-Site Scripting (XSS) in org.springframework.security:spring-security-saml2-service-provider (CVE-2026-41003)
cross-site scripting in org.springframework.security:spring-security-saml2-service-provider (CVE-2026-41003). Confidential information can be exposed externally.
|
| CVE-2026-41008 |
|
Open Redirect in org.springframework.security:spring-security-oauth2-authorization-server (CVE-2026-41008)
vulnerability in org.springframework.security:spring-security-oauth2-authorization-server (CVE-2026-41008). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `1.5.8` or later.
|
| CVE-2026-41706 |
|
Open Redirect in org.springframework.security:spring-security-web (CVE-2026-41706)
vulnerability in org.springframework.security:spring-security-web (CVE-2026-41706). Risk of unauthorized operations or information disclosure.
|
| CVE-2026-40988 |
|
Vulnerability in org.springframework.security:spring-security-saml2-service-provider (CVE-2026-40988)
vulnerability in org.springframework.security:spring-security-saml2-service-provider (CVE-2026-40988). Risk of unauthorized operations or information disclosure.
|
| CVE-2026-40993 |
|
Unsafe Deserialization in org.springframework.security:spring-security-saml2-service-provider (CVE-2026-40993)
vulnerability in org.springframework.security:spring-security-saml2-service-provider (CVE-2026-40993). Data can be tampered with by attackers. Mitigation: upgrade to `7.0.6` or later.
|
| CVE-2026-41694 |
|
Vulnerability in org.springframework.security:spring-security-saml2-service-provider (CVE-2026-41694)
vulnerability in org.springframework.security:spring-security-saml2-service-provider (CVE-2026-41694). Risk of unauthorized operations or information disclosure.
|
| CVE-2026-22754 |
|
Vulnerability in vmware (CVE-2026-22754)
vulnerability in vmware (CVE-2026-22754). Data can be tampered with by attackers.
|
| CVE-2026-22747 |
|
Vulnerability in vmware (CVE-2026-22747)
vulnerability in vmware (CVE-2026-22747). Confidential information can be exposed externally.
|
| CVE-2018-1258 |
|
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauth...
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
|
| CVE-2017-4995 |
|
Unsafe Deserialization in deserialization (CVE-2017-4995)
vulnerability in deserialization (CVE-2017-4995). Successful exploitation can lead to full system takeover.
|
| CVE-2014-0097 |
|
Authentication Bypass in vmware (CVE-2014-0097)
authentication bypass in vmware (CVE-2014-0097). Risk of unauthorized operations or information disclosure.
|
| CVE-2014-3527 |
|
Authentication Bypass in vmware (CVE-2014-3527)
authentication bypass in vmware (CVE-2014-3527). Successful exploitation can lead to full system takeover.
|
| CVE-2016-5007 |
|
Vulnerability in spring (CVE-2016-5007)
vulnerability in spring (CVE-2016-5007). Data can be tampered with by attackers.
|