Product by Vmware Tanzu
Spring Cloud
15 known vulnerabilities in Spring Cloud (Vmware Tanzu), 0 of them actively exploited (CISA KEV).
Key figures
15
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-47837 | Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests | 6.8 | |
| High | CVE-2026-47879 | Spring Cloud Gateway SSRF and native file access with gRPC | 7.7 | |
| Medium | CVE-2026-59284 | Spring Cloud Commons no allow list for writable env actuator endpoint | 6.6 | |
| High | CVE-2026-47894 | Spring Cloud Config Server Native Environment Repository Exposure | 4.9 | |
| High | CVE-2026-47836 | Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN | 7.2 | |
| Medium | CVE-2026-59302 | Potential for logging sensitive data in Spring Cloud Stream | 3.1 | |
| Medium | CVE-2026-59301 | Potential for logging sensitive data in Spring Cloud Function Azure | 3.1 | |
| Low | CVE-2026-59306 | Potential for deserialization of untrusted types in Spring Cloud Stream | 3.1 | |
| Low | CVE-2026-59298 | Potential for improper filtering of HTTP headers in Spring Cloud Function | 3.1 | |
| Low | CVE-2026-59304 | Improper caching of the original content type in Spring Cloud Stream Avro | 3.1 | |
| Low | CVE-2026-59299 | Composition lookup can potentially poison base function in Spring Cloud Function | 3.1 | |
| Low | CVE-2026-59303 | Dynamic destination cache size is not properly bound in Spring Cloud Stream | 3.1 | |
| Low | CVE-2026-59300 | Potential for logging sensitive data in Spring Cloud Function AWS | 3.1 | |
| Low | CVE-2026-59297 | Spring Cloud Function can incorrectly determine if URI is secure | 3.1 | |
| Medium | CVE-2026-59291 | Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function | 2.0 |