SS
Product
Spring Security
44
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 19Medium 17Low 1
Watch
Add Spring Security to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-34034 | 9.8 | Jul 19 | Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a… Affected: 5.6.0 before 5.6.12; 5.7.0 before 5.7.10; 5.8.0 before 5.8.5; 6.0.0 before 6.0.5; 6.1.0 before 6.1.2 |
| CVE-2022-31692 | 9.8 | Oct 31 | Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types Affected: 5.6.0 before 5.6.9; 5.7.0 before 5.7.5 |
| CVE-2022-22978 | 9.8 | May 19 | In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet… Affected: before 5.5.7; 5.6.0 before 5.6.4 |
| CVE-2014-3527 | 9.8 | May 25 | When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that… Affected: 3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.2.0; +4 more |
| CVE-2026-59270 | 9.1 | Aug 27 | Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces Affected: 5.7.0 before 5.7.26; 5.8.0 before 5.8.28; 6.4.0 before 6.4.19; 6.5.0 before 6.5.12; 7.0.0 before 7.0.6.1; 7.1.0 before 7.1.0.1 |
| CVE-2026-22732 | 9.1 | Mar 19 | Under Some Conditions Spring Security HTTP Headers Are not Written Affected: 5.7.0 through 5.7.21; 5.8.0 through 5.8.23; 6.3.0 through 6.3.14; 6.4.0 through 6.4.14; 6.5.0 through 6.5.8; 7.0.0 through 7.0.3 |
Showing 6