2026

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these m

A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — fu

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an at

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative creden

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configure

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by inc

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predi

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the ma

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fr

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite att

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spr

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a con

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping th

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue ap

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for examp

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto de

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes di

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding.

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deser

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and

Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Pa

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators,

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 doe

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 doe

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of it

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes

A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service i

A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function read_conte

A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the

“unsupported-when-assigned.” An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown functio

In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-sc

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor N

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a

An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can caus

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the c

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frame

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a

Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type,