Login Request a demo
SB
Product
Spring Boot
by Vmware · last CVE Jun 11, 2026
20
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities20In the news0Timeline
Severity mix
Critical 6High 8Medium 6Low 0
Severity
All severities20Critical6High8Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Spring Boot to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-40974
9.8
0%
Apr 27
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra
Affected: 2.7.0 before 2.7.33; 3.3.0 before 3.3.19; 3.4.0 before 3.4.16; 3.5.0 before 3.5.14; 4.0.0 before 4.0.6
CVE-2023-20873
9.8
1%
Apr 20
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass
Affected: before 2.5.15; 2.6.0 before 2.6.14; 2.7.0 before 2.7.11; 3.0.0 before 3.0.6
CVE-2021-26987
9.8
2%
Mar 15
Element Plug-in for vCenter Server incorporates SpringBoot Framework
Affected: before 1.3.2
CVE-2017-8046
9.8
75%
Jan 4
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to…
Affected: before 1.5.9; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0
CVE-2026-40976
9.1
0%
Apr 27
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints
Affected: 4.0.0 before 4.0.6
CVE-2026-40971
9.1
0%
Apr 27
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker
Affected: 3.5.0 before 3.5.14; 4.0.0 before 4.0.6
Showing 6