SF
Product
Spring Framework
37
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 13Medium 16Low 1
Watch
Add Spring Framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-41854 | 6.5 | Jun 9 | Spring Framework Server-Side Request Forgery via UriComponentsBuilder Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1 |
| CVE-2026-59281 | 6.1 | Aug 27 | Spring Framework Cross-site Scripting via EscapedErrors Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19; 6.1.0 through 6.1.28; 6.0.0 through 6.0.30; 5.3.0 through 5.3.49; through 5.2.25.RELEASE |
| CVE-2026-47887 | 6.1 | Aug 27 | Spring Framework Open Redirect in UrlFileNameViewController Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19; 6.1.0 through 6.1.28; 6.0.0 through 6.0.30; 5.3.0 through 5.3.49; through 5.2.25.RELEASE |
| CVE-2026-47883 | 6.1 | Aug 27 | Spring Framework Open Redirect in UrlHandlerFilter Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19 |
| CVE-2026-41846 | 6.1 | Jun 9 | Spring Framework Cross-site Scripting via JSP Form Tags Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2026-41845 | 6.1 | Jun 9 | Spring Framework Cross-site Scripting via JavaScriptUtils Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2026-41844 | 6.1 | Jun 9 | Spring Framework Open Redirect in Spring MVC and WebFlux Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2026-41843 | 5.9 | Jun 9 | Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2026-41841 | 5.9 | Jun 9 | Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2026-41840 | 5.9 | Jun 9 | Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2026-22737 | 5.9 | Mar 19 | Spring Framework Improper Path Limitation with Script View Templates Affected: 7.0.0 through 7.0.5; 6.2.0 through 6.2.16; 6.1.0 through 6.1.25; 5.3.0 through 5.3.46 |
| CVE-2026-41853 | 5.3 | Jun 9 | Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2026-41852 | 5.3 | Jun 9 | Spring Framework Arbitrary Method Invocation in SpEL Expressions Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2026-41847 | 5.3 | Jun 9 | Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL Affected: 5.3.0 before 5.3.49 |
| CVE-2026-59280 | 4.3 | Aug 27 | Spring Framework Path Traversal via Backslash in SpringTemplateLoader Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19; 6.1.0 through 6.1.28; 6.0.0 through 6.0.30; 5.3.0 through 5.3.49; through 5.2.25.RELEASE |
| CVE-2026-41839 | 4.2 | Jun 9 | Spring Framework Escalation via Session Fixation in WebFlux Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
Showing 16