SB
Product
Spring Boot
20
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 8Medium 6Low 0
Watch
Add Spring Boot to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-22733 | 8.1 | Mar 20 | Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under… Affected: before 2.7.32; 3.3.0 before 3.3.18; 3.4.0 before 3.4.15; 3.5.0 before 3.5.12; 4.0.0 before 4.0.4 |
| CVE-2026-22731 | 8.1 | Mar 19 | Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a… Affected: 3.4.0 before 3.4.15; 3.5.0 before 3.5.12; 4.0.0 before 4.0.4 |
| CVE-2022-27772 | 7.8 | Mar 30 | spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking Affected: before 2.2.11 |
| CVE-2026-40975 | 7.5 | Apr 27 | Values produced by ${random.value} are not suitable for use as secrets Affected: before 2.7.33; 3.3.0 before 3.3.19; 3.4.0 before 3.4.16; 3.5.0 before 3.5.14; 4.0.0 before 4.0.6 |
| CVE-2026-40972 | 7.5 | Apr 27 | An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret Affected: before 2.7.33; 3.3.0 before 3.3.19; 3.4.0 before 3.4.16; 3.5.0 before 3.5.14; 4.0.0 before 4.0.6 |
| CVE-2023-20883 | 7.5 | May 26 | In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if… Affected: before 2.5.14; 2.6.0 through 2.6.14; 2.7.0 through 2.7.11; 3.0.0 through 3.0.6 |
| CVE-2023-22602 | 7.5 | Jan 14 | When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass Affected: 2.6.0 |
| CVE-2026-40973 | 7.0 | Apr 27 | A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp` Affected: before 2.7.33; 3.3.0 before 3.3.19; 3.4.0 before 3.4.16; 3.5.0 before 3.5.14; 4.0.0 before 4.0.6 |
Showing 8