Known vulnerabilities in Spring Framework - page 2
Vendor:
Broadcom
Software:
Spring Framework
Software CPE:
cpe:2.3:a:broadcom:pivotal_spring_framework:*:*:*:*:*:*:*:*
Website:
https://www.broadcom.com/
Total vulnerabilities:
77
Public exploits:
4
Known exploited (KEV):
1
Breakdown by Severity Chart
7.1.0-M2
5.2.26
5.3.50
6.0.31
6.1.29
6.2.20
7.0.8.1
5.3.49
6.1.28
6.2.18.1
7.0.7.1
7.1.0-M1
7.0.9
7.0.8
6.2.19
5.3.48
6.1.27
7.0.7
6.2.18
5.3.47
6.1.26
6.1.25
7.0.6
6.2.17
7.0.5
7.0.4
6.2.16
7.0.3
7.0.2
6.2.15
7.0.1
6.2.14
7.0.0
6.2.13
7.0.0-RC3
7.0.0-RC2
7.0.0-RC1
6.2.12
6.1.24
5.3.46
5.3.45
6.1.23
7.0.0-M9
6.2.11
7.0.0-M8
5.3.44
6.1.22
6.2.10
7.0.0-M7
6.2.9
6.0.29
7.0.0-M6
6.2.8
6.1.21
5.3.43
6.0.28
6.0.27
6.0.26
7.0.0-M5
6.2.7
6.1.20
7.0.0-M4
6.2.6
6.1.19
6.2.5
7.0.0-M3
6.2.4
6.1.18
7.0.0-M2
6.2.3
6.1.17
7.0.0-M1
6.2.2
6.2.1
6.1.16
5.3.42
6.2.0
6.1.15
6.2.0-RC3
6.0.25
5.3.41
6.2.0-RC2
6.1.14
6.0.24
5.3.40
6.2.0-RC1
6.1.13
6.2.0-M7
6.1.12
6.0.23
5.3.39
5.3.38
6.2.0-M6
6.2.0-M5
6.1.11
6.1.10
6.2.0-M4
6.1.9
6.0.22
5.3.37
6.2.0-M3
6.1.8
6.0.21
5.3.36
6.2.0-M2
6.1.7
6.0.20
5.3.35
2.5.7.SR023
2.5.6.SEC03
6.2.0-M1
6.1.6
6.0.19
5.3.34
6.1.5
6.0.18
5.3.33
6.1.4
6.0.17
5.3.32
6.1.3
6.0.16
6.1.2
6.0.15
6.1.1
6.1.0
6.0.14
5.3.31
6.1.0-RC2
6.1.0-RC1
6.0.13
6.1.0-M5
6.0.12
5.3.30
6.1.0-M4
6.1.0-M3
6.1.0-M2
6.0.11
5.3.29
5.2.25
6.1.0-M1
6.0.10
5.3.28
6.0.9
6.0.8
5.3.27
5.2.24
5.2.23
6.0.7
5.3.26
6.0.6
6.0.5
6.0.4
5.3.25
6.0.3
6.0.2
6.0.1
6.0.0
5.3.24
6.0.0-RC4
6.0.0-RC3
6.0.0-RC2
6.0.0-RC1
5.3.23
6.0.0-M6
6.0.0-M5
5.3.22
5.3.21
6.0.0-M4
5.3.20
5.2.22
5.2.21
5.3.19
5.2.20
5.3.18
6.0.0-M3
6.0.0-M2
6.0.0-M1
5.3.17
5.3.16
5.3.15
5.3.14
5.3.13
5.3.12
5.3.11
5.3.10
5.3.9
5.3.8
5.3.0-RC2
5.3.0-RC1
5.3.0-M2
5.3.0-M1
5.2.19
5.2.18
5.2.17
5.2.16
5.2.0-RC2
5.2.0-RC1
5.2.0-M3
5.2.0-M2
5.2.0-M1
5.1.20
5.1.19
5.1.18
5.1.17
5.1.16
5.1.15
5.1.14
5.1.0-RC3
5.1.0-RC2
5.1.0-RC1
5.0.20
5.0.19
5.0.18
5.0.17
5.0.0-RC4
5.0.0-RC3
5.0.0-RC2
5.0.0-RC1
5.0.0-M5
5.0.0-M4
5.0.0-M3
5.0.0-M2
5.0.0-M1
4.3.30
4.3.29
4.3.28
4.3.27
4.3.0-RC2
4.3.0-RC1
4.2.0-RC3
4.2.0-RC2
4.2.0-RC1
4.1.0-RC2
4.1.0-RC1
4.0.0-RC2
4.0.0-RC1
4.0.0-M3
4.0.0-M2
4.0.0-M1
3.2.0-RC2-A
3.2.0-RC2
3.2.0-RC1
3.2.0-M2
3.2.0-M1
3.1.0-RC2
3.1.0-RC1
3.1.0-M2
3.1.0-M1
3.0.1-A
3.0.0-RC3
3.0.0-RC2
3.0.0-RC1
3.0.0-M4
3.0.0-M3
3.0.0-M2
3.0.0-M1
5.2.15
5.2.14
5.2.13
5.2.12
5.2.11
5.2.10
5.2.9
5.2.8
5.2.7
5.2.6
5.2.5
5.2.4
5.3.7
5.3.6
5.3.5
5.3.4
5.3.3
5.3.2
5.3.1
5.3.0
5.2.3
5.2.2
5.2.1
5.2.0
5.1.13
5.1.12
5.1.11
5.1.10
5.1.9
5.1.8
5.1.7
5.1.6
5.1.5
5.1.4
5.1.3
5.1.2
5.0.16
5.0.15
5.0.14
5.0.13
5.0.12
5.0.11
4.3.26
4.3.25
4.3.24
4.3.23
4.3.22
4.3.21
4.3.19
4.1.9
4.1.8
4.1.7
4.1.6
4.1.3
4.1.2
4.1.1
4.0.9
4.0.8
4.0.7
4.0.6
4.0.5
4.0.4
4.0.3
4.0.2
4.0.1
4.0.0
3.2.18
3.2.17
3.2.16
3.2.15
3.2.14
3.2.13
3.2.12
3.2.11
3.2.10
3.2.9
3.2.8
3.2.7
3.2.6
3.2.5
3.2.4
3.2.3
3.2.2
3.2.1
3.2.0
3.1.4
3.1.3
3.1.2
3.1.1
3.1.0
3.0.7
3.0.6
3.0.5
3.0.4
3.0.3
3.0.2
3.0.1
3.0.0
5.1.1
4.3.20
5.0.10
4.2.18
4.2.17
4.2.16
4.2.15
4.2.14
4.2.13
4.2.12
4.2.11
4.2.10
4.2.9
4.2.8
4.2.7
4.2.6
4.2.5
4.2.4
4.2.3
4.2.2
4.2.1
4.2.19
5.1.0
5.0.9
5.0.8
5.0.7
4.3.18
4.3.17
5.0.6
4.3.16
4.3.15
5.0.5
5.0.4
5.0.3
5.0.2
5.0.1
5.0.0
4.3.14
4.3.13
4.3.12
4.3.11
4.3.10
4.3.9
4.3.8
4.3.7
4.3.6
4.3.5
4.3.4
4.3.3
4.3.2
4.3.1
4.3.0
4.1.5
4.1.4
4.4
4.2
4.1
Vulnerabilities (77)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU146415 - Improper input validation CVE-2026-41854 |
CWE-20 | Low | 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 31.08.2026 |
SB20260828154 SB20260917195 SB20260919172 |
||
| #VU146414 - Deserialization of Untrusted Data CVE-2026-41855 |
CWE-502 | High | 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 31.08.2026 |
SB20260828154 SB2026100258 |
||
| #VU146413 - Allocation of Resources Without Limits or Throttling CVE-2026-41850 |
CWE-770 | Medium | 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 31.08.2026 |
SB20260828154 SB2026083172 SB2026083181 and 1 more |
||
| #VU146412 - Protection Mechanism Failure CVE-2026-41852 |
CWE-693 | Low | 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 31.08.2026 |
SB20260828154 SB2026092114 |
||
| #VU146411 - Improper input validation CVE-2026-41853 |
CWE-20 | Medium | 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 31.08.2026 |
SB20260828154 SB20260917195 SB20260919172 |
||
| #VU146410 - Resource exhaustion CVE-2026-41851 |
CWE-400 | Medium | 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 31.08.2026 |
SB20260828154 SB2026083172 SB2026083181 and 1 more |
||
| #VU146407 - Protection Mechanism Failure CVE-2026-41847 |
CWE-693 | Medium | 5.3.49 | 31.08.2026 |
SB20260828154 |
||
| #VU146176 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-41846 |
CWE-79 | Medium | 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 28.08.2026 |
SB20260828154 SB2026092115 |
||
| #VU146173 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2026-41843 |
CWE-22 | Medium | 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 28.08.2026 |
SB20260828154 SB2026092115 |
||
| #VU146172 - URL Redirection to Untrusted Site ('Open Redirect') CVE-2026-41844 |
CWE-601 | Low | 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 28.08.2026 |
SB20260828154 SB2026092115 |
||
| #VU146171 - Session Fixation CVE-2026-41839 |
CWE-384 | Low | 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 28.08.2026 |
SB20260828154 SB20260917195 SB20260919172 and 1 more |
||
| #VU146170 - Resource exhaustion CVE-2026-41842 |
CWE-400 | Medium | 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 28.08.2026 |
SB20260828154 SB2026083172 SB2026083181 and 3 more |
||
| #VU146169 - Improper Access Control CVE-2026-41841 |
CWE-284 | Medium | 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 28.08.2026 |
SB20260828154 SB20260917195 SB2026092115 |
||
| #VU146167 - Generation of Predictable Numbers or Identifiers CVE-2026-41838 |
CWE-340 | Low | 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 28.08.2026 |
SB20260828154 SB2026100258 |
||
| #VU146166 - Missing release of memory after effective lifetime CVE-2026-41840 |
CWE-401 | Medium | 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 | 28.08.2026 |
SB20260828154 SB20260917195 SB20260919172 and 1 more |
||
| #VU128385 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CVE-2026-22735 |
CWE-74 | Low | 5.3.47, 6.1.26, 6.2.17, 7.0.6 | 28.04.2026 |
SB20260428206 SB2026043058 SB2026052217 and 4 more |
||
| #VU128372 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2026-22737 |
CWE-22 | Medium | 5.3.47, 6.1.26, 6.2.17, 7.0.6 | 28.04.2026 |
SB20260428206 SB2026043058 SB2026052218 and 4 more |
||
| #VU126710 - Resource exhaustion CVE-2026-22745 |
CWE-400 | Medium | 5.3.48, 6.1.27, 6.2.18, 7.0.7 | 21.04.2026 |
SB2026042162 SB2026052514 SB2026060904 and 3 more |
||
| #VU126709 - Acceptance of Extraneous Untrusted Data With Trusted Data CVE-2026-22741 |
CWE-349 | Low | 5.3.48, 6.1.27, 6.2.18, 7.0.7 | 21.04.2026 |
SB2026042162 SB2026052514 SB20260528259 and 4 more |
||
| #VU126708 - Improper Resource Shutdown or Release CVE-2026-22740 |
CWE-404 | Low | 5.3.48, 6.1.27, 6.2.18, 7.0.7 | 21.04.2026 |
SB2026042162 SB2026052514 SB2026060812 and 3 more |
Showing elements 21 - 40 out of 77