Spring vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
32 matching records
- Low3.1CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names.Check if you run itEPSS 0.43%May 16, 2025
- High7.3EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.Check if you run itEPSS 0.44%Apr 28, 2025
- UnknownVMware Spring Framework Unintended Proxy or Intermediary ('Confused Deputy')Patch nowKEVEPSS 10.21%Feb 25, 2025
- UnknownSpring Framework WebMvc.fn or WebFlux.fn Path Traversal VulnerabilityPatch nowKEVEPSS 21.26%Oct 22, 2024
- UnknownVMware Spring Framework Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 13.23%May 31, 2022
- Critical9.8Spring Framework JDK 9+ Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.64%Apr 1, 2022
- UnknownVMware Spring Framework Improper Input ValidationPatch nowKEVEPSS 74.53%May 20, 2019