Spring CVE-2026-22718

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. Rated critical severi

Access control bypass in SpringBlade v4.5.0 importUser function allows low-privileged users to import sensitive user dat

Spring Cloud Config Server contains a path traversal vulnerability when using the native file system backend, allowing u

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant

SpringBlade v4.5.0 has an access control flaw in authRoutes allowing low-privileged users to escalate to admin through t

Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated at

Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across

Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Sprin

Unsafe JSON deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJso

Spring Security Aspects may not correctly locate method security annotations on private methods. Rated critical severity

Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input esca

Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files