SB
Product
Spring Boot
11
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 4Medium 4Low 0
Watch
Add Spring Boot to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-40974 | 9.8 | Apr 27 | Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra Affected: 4.0.0 before 4.0.6; 3.5.0 before 3.5.14; 3.4.0 before 3.4.16; 3.3.0 before 3.3.19; 2.7.0 before 2.7.33 |
| CVE-2026-40976 | 9.1 | Apr 27 | In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints Affected: 4.0.0 before 4.0.6 |
| CVE-2026-40971 | 9.1 | Apr 27 | When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker Affected: 4.0.0 before 4.0.6; 3.5.0 before 3.5.14 |
| CVE-2026-22731 | 8.1 | Mar 19 | Authentication Bypass under Actuator Health groups paths Affected: 4.0 before 4.0.3; 3.5 before 3.5.11; 3.4 before 3.4.15 |
| CVE-2026-40975 | 7.5 | Apr 27 | Values produced by ${random.value} are not suitable for use as secrets Affected: 4.0.0 before 4.0.6; 3.5.0 before 3.5.14; 3.4.0 before 3.4.16; 3.3.0 before 3.3.19; 2.7.0 before 2.7.33 |
| CVE-2026-40972 | 7.5 | Apr 27 | An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret Affected: 4.0.0 before 4.0.6; 3.5.0 before 3.5.14; 3.4.0 before 3.4.16; 3.3.0 before 3.3.19; 2.7.0 before 2.7.33 |
| CVE-2026-40973 | 7.0 | Apr 27 | A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp` Affected: 4.0.0 before 4.0.6; 3.5.0 before 3.5.14; 3.4.0 before 3.4.16; 3.3.0 before 3.3.19; 2.7.0 before 2.7.33 |
| CVE-2026-40970 | 6.8 | Apr 27 | When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server Affected: 4.0.0 before 4.0.6 |
| CVE-2026-40977 | 6.7 | Apr 27 | When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the… Affected: 4.0.0 before 4.0.6; 3.5.0 before 3.5.14; 3.4.0 before 3.4.16; 3.3.0 before 3.3.19; 2.7.0 before 2.7.33 |
| CVE-2026-41001 | 5.3 | Jun 11 | Predictable Temp Directory in Artemis Auto-configuration Affected: 4.0.0 before 4.0.6.1; 3.5.0 before 3.5.14.1; 3.4.0 before 3.4.17; 3.3.0 before 3.3.20; 2.7.0 before 2.7.34 |
| CVE-2026-40992 | 5.0 | Jun 11 | Mail Auto-Configuration Does Not Enable SSL Hostname Verification Affected: 4.0.0 before 4.0.6.1; 3.5.0 before 3.5.14.1; 3.4.0 before 3.4.17 |
Showing 11