SW
Product
Spring Web Services
8
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 3Low 1
Watch
Add Spring Web Services to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-40999 | 8.6 | Jun 11 | Spring WS SSRF via unvalidated WS-Addressing reply destinations Affected: before 3.1.9; 4.0.0 before 4.0.19; 4.1.0 before 4.1.3.1; 5.0.0 before 5.0.1.1 |
| CVE-2026-40998 | 8.2 | Jun 11 | Jaxp13 XPath XXE via StreamSource and SAXSource Affected: before 3.1.9; 4.0.0 before 4.0.19; 4.1.0 before 4.1.3.1; 5.0.0 before 5.0.1.1 |
| CVE-2026-40994 | 8.2 | Jun 11 | Wss4jSecurityInterceptor disables WS-I BSP validation by default Affected: before 3.1.9; 4.0.0 before 4.0.19; 4.1.0 before 4.1.3.1; 5.0.0 before 5.0.1.1 |
Showing 3