Product by Spring
Spring Boot
16 known vulnerabilities in Spring Boot (Spring), 0 of them actively exploited (CISA KEV).
Key figures
16
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-40976 | Spring Boot: Missing Authorization | 9.1 | |
| Medium | CVE-2023-34055 | Spring Boot server Web Observations DoS Vulnerability | 5.3 | |
| High | CVE-2026-22733 | Authentication Bypass under Actuator CloudFoundry endpoints | 8.2 | |
| High | CVE-2026-22731 | Authentication Bypass under Actuator Health groups paths | 8.2 | |
| High | CVE-2025-22235 | Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed | 7.3 | |
| High | CVE-2026-40972 | Spring Boot: Observable Timing Discrepancy | 7.5 | |
| Medium | CVE-2019-3797 | Additional information exposure with Spring Data JPA derived queries | 3.5 | |
| High | CVE-2026-40973 | Spring Boot: Insecure Temporary File | 7.0 | |
| Medium | CVE-2026-40970 | Spring Boot: Improper Certificate Validation | 6.8 | |
| High | CVE-2026-40975 | Spring Boot: Use of Insufficiently Random Values | 4.8 | |
| Medium | CVE-2026-41001 | Predictable Temp Directory in Artemis Auto-configuration | 5.3 | |
| Medium | CVE-2026-40992 | Mail Auto-Configuration Does Not Enable SSL Hostname Verification | 5.0 | |
| Critical | CVE-2026-40974 | Spring Boot: Improper Certificate Validation | 5.0 | |
| Critical | CVE-2026-40971 | Spring Boot: Improper Certificate Validation | 5.0 | |
| Medium | CVE-2026-40977 | Spring Boot: Link Following | 4.7 | |
| Medium | CVE-2024-38807 | Spring Boot: security vulnerability | 6.3 |