CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,501 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,501
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product spring:integration. Show all products

14 CVEs, showing 1 to 14
CVESeverityTitlePublished
CVE-2026-59324High 8.2fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
Assigned by vmware
Aug 27, 2026
CVE-2026-59322Medium 6.3EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders
Assigned by vmware
Aug 27, 2026
CVE-2026-59321Medium 4.2Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check
Assigned by vmware
Aug 27, 2026
CVE-2026-59311Medium 6.8Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
Assigned by vmware
Aug 27, 2026
CVE-2026-59307High 8.0Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
Assigned by vmware
Aug 27, 2026
CVE-2026-59293Medium 6.6SMB minimum protocol dialect defaults to SMB1
Assigned by vmware
Aug 27, 2026
CVE-2026-59292Low 3.2World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)
Assigned by vmware
Aug 27, 2026
CVE-2026-59274Medium 6.5Unbounded decompression in UnZipTransformer enables zip-bomb DoS
Assigned by vmware
Aug 27, 2026
CVE-2026-47880Medium 5.4DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names
Assigned by vmware
Aug 27, 2026
CVE-2026-47864Medium 6.4Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
Assigned by vmware
Aug 27, 2026
CVE-2026-47861Medium 6.3UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false
Assigned by vmware
Aug 26, 2026
CVE-2026-47862Medium 5.4ZipTransformer uses file_name header to build workDirectory path without sanitization
Assigned by vmware
Aug 26, 2026
CVE-2026-47859Medium 5.4Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
Assigned by vmware
Aug 26, 2026
CVE-2026-47856Medium 6.3JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list
Assigned by vmware
Aug 26, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.