Product by Vmware Tanzu
Spring Security
26 known vulnerabilities in Spring Security (Vmware Tanzu), 0 of them actively exploited (CISA KEV).
Key figures
26
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-41232 | Spring Security: security vulnerability | 9.1 | |
| Critical | CVE-2026-22732 | Under Some Conditions Spring Security HTTP Headers Are not Written | 9.1 | |
| Critical | CVE-2026-22752 | Spring Authorization Server: Improper Authentication | 9.6 | |
| Critical | CVE-2026-59270 | Spring Security: security vulnerability | 9.4 | |
| High | CVE-2026-41707 | Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay | 7.4 | |
| High | CVE-2026-47877 | Spring Security: Cross-Site Scripting (XSS) | 8.2 | |
| High | CVE-2026-47841 | WebAuthn User Verification Bypass via Session Serialization | 7.4 | |
| High | CVE-2026-22733 | Authentication Bypass under Actuator CloudFoundry endpoints | 8.2 | |
| High | CVE-2026-40988 | Unbounded DEFLATE Inflation in SAML 2.0 Service Provider | 7.5 | |
| High | CVE-2025-41248 | VMware Spring Security: security vulnerability | 7.5 | |
| Medium | CVE-2026-59276 | Timing Attack via Non-Constant-Time Comparison of Sensitive Values | 5.9 | |
| High | CVE-2026-22747 | Unauthorized User Impersonation when Using X.509 Client Certificates | 8.1 | |
| High | CVE-2026-41003 | Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting | 7.6 | |
| Medium | CVE-2026-47842 | Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation | 6.5 | |
| High | CVE-2026-22754 | ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules | 7.5 | |
| High | CVE-2026-22753 | Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers | 7.5 | |
| High | CVE-2026-40993 | Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry | 7.3 | |
| High | CVE-2026-47838 | Unauthorized User Impersonation when Using X.509 Client Certificates | 6.8 | |
| Medium | CVE-2026-41706 | Open Redirect When Using CookieRequestCache | 6.1 | |
| Medium | CVE-2026-22748 | Potential Security Misconfiguration when Using withIssuerLocation | 6.5 | |
| Medium | CVE-2026-41008 | Spring Security Authorization Server Open Redirect via request_uri | 6.1 | |
| Medium | CVE-2026-59277 | Spring Security InetAddressMatchers Incomplete Internal Network Classification | 3.7 | |
| Medium | CVE-2026-22751 | Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions | 4.8 | |
| Medium | CVE-2023-34042 | Spring Security: security vulnerability | 4.1 | |
| Medium | CVE-2026-41694 | SAML Payloads Decrypted Without Valid Signature | 3.7 |