CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,437 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,437
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product spring:framework. Show all products

19 CVEs, showing 1 to 19
CVESeverityTitlePublished
CVE-2026-59314Low 3.7Spring Framework response splitting in ContentDisposition
Assigned by vmware
Aug 27, 2026
CVE-2026-59313Critical 9.8Server Sent Event stream corruption in Spring MVC functional web framework
Assigned by vmware
Aug 27, 2026
CVE-2026-59283Critical 9.1Spring Framework Safety Guard Bypass via SpEL Expression Compilation
Assigned by vmware
Aug 27, 2026
CVE-2026-59282High 7.5Spring Framework Denial of Service via Unbounded List Growth in Data Binding
Assigned by vmware
Aug 27, 2026
CVE-2026-59281Medium 6.1Spring Framework Cross-site Scripting via EscapedErrors
Assigned by vmware
Aug 27, 2026
CVE-2026-59280Medium 4.3Spring Framework Path Traversal via Backslash in SpringTemplateLoader
Assigned by vmware
Aug 27, 2026
CVE-2026-47893High 7.5Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService
Assigned by vmware
Aug 27, 2026
CVE-2026-47892Critical 9.8Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
Assigned by vmware
Aug 27, 2026
CVE-2026-47891Critical 9.8Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
Assigned by vmware
Aug 27, 2026
CVE-2026-47890Critical 9.8Spring Framework Server Sent Event stream corruption while rendering fragments
Assigned by vmware
Aug 27, 2026
CVE-2026-47889High 7.5Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
Assigned by vmware
Aug 27, 2026
CVE-2026-47888High 7.5Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
Assigned by vmware
Aug 27, 2026
CVE-2026-47887Medium 6.1Spring Framework Open Redirect in UrlFileNameViewController
Assigned by vmware
Aug 27, 2026
CVE-2026-47886High 7.5Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions
Assigned by vmware
Aug 27, 2026
CVE-2026-47885High 7.5Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
Assigned by vmware
Aug 27, 2026
CVE-2026-47884Critical 9.8Spring Framework Improper Path Limitation in XsltView
Assigned by vmware
Aug 27, 2026
CVE-2026-47883Medium 6.1Spring Framework Open Redirect in UrlHandlerFilter
Assigned by vmware
Aug 27, 2026
CVE-2020-5397
Healthcare
Medium 5.3CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux
Assigned by pivotal
Jan 17, 2020
CVE-2020-5398
Healthcare
High 8.0RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
Assigned by pivotal
Jan 16, 2020

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.