Java
Monthly
Unauthenticated password reset in jaychouchannel's Tourism-Management-System allows any remote attacker to overwrite an arbitrary user's credentials by supplying only a known username to the resetPass endpoint - no current password, token, or session is required. All three Java Spring controllers (UsersController, DaoyouController, YonghuController) share the vulnerable pattern, enabling forced account lockout or, if the API response includes the newly generated random password, full account takeover. Publicly disclosed exploit code exists and the upstream fix is available via commit 9cb6215.
Unauthenticated remote attackers can register accounts with elevated (administrator) privileges in jaychouchannel Tourism-Management-System by manipulating the UsersEntity parameter during registration, bypassing role assignment controls. The commit diff reveals a broader scope than the description implies: at least 12 controller classes (ChatmessageController, multiple Discuss* controllers, ForumController, FriendController, FriendlinkController, NewsController, NewstypeController, StoreupController) had security() endpoints decorated with @IgnoreAuth, making those endpoints callable without any authentication. Publicly available exploit code exists; no active exploitation confirmed in CISA KEV.
Authorization bypass in jaychouchannel's Tourism-Management-System allows authenticated remote users to access or modify ticket order records belonging to other users by manipulating the ID parameter in CRUD operations against MenpiaodingdanController.java. This is a classic Insecure Direct Object Reference (IDOR) pattern where the application fails to verify that the requesting user owns the referenced resource. A publicly available proof-of-concept exists (GitHub issue #9), and a patch has been committed (d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86), though no versioned release is available due to the project's rolling-release approach.
Authorization bypass in jaychouchannel's Tourism-Management-System (all Java/Spring Boot commits through 84d8ec384f) allows low-privileged authenticated users to invoke protected `security()` endpoints across 12 controllers by exploiting misapplied `@IgnoreAuth` annotations that instruct the AuthorizationInterceptor to skip permission enforcement entirely. The affected endpoints span chat, discussion, forum, friend, news, and store-bookmark controllers, exposing user security data and privileged actions to callers who lack the required roles. Publicly available exploit code exists via GitHub issue #12; the vendor has released a patch commit removing the offending annotations.
SQL injection in GongShengyue OnlineBooks allows authenticated remote attackers to manipulate database queries through the `column` parameter of the listSplit interface in BooksServlet.java. The vulnerability enables partial data extraction, modification, and potential availability impact against the backend database. A public proof-of-concept exploit has been published on GitHub, raising near-term exploitation probability for any internet-exposed deployments.
Hard-coded AES encryption in dromara orion-visor up to version 2.5.7 renders all SSH private keys and host passwords stored by the application recoverable by any attacker who can access the data store. The vulnerable function `HostKeyServiceImpl.encryptKey` in the asset-service module applies a fixed, unchanging key that is embedded in the publicly available GitHub source - making the key universally known to anyone who inspects the repository. A proof-of-concept demonstrating full plaintext recovery of stored SSH credentials has been publicly disclosed, and the maintainer has not responded to the issue report.
Remote code execution in Xuxueli xxl-job up to version 3.4.2 allows authenticated low-privileged users to execute arbitrary code on the executor host via the GLUE mode Groovy script handler in GlueFactory.java. The root cause is that GroovyClassLoader.parseClass processes attacker-supplied Groovy source directly, compiling and running it without a restrictive sandbox. A public proof-of-concept exploit targeting v3.4.2 has been released on GitHub, and the vendor did not respond to the coordinated disclosure.
Improper privilege management in xxl-job admin up to version 3.4.2 exposes the `loadById` endpoint of `JobGroupController.java` to unauthorized access by low-privileged authenticated users, leaking executor group configuration data. The vulnerability resides in the admin web interface's job group management controller and allows users who should lack access to read job group details via direct endpoint calls. A public proof-of-concept exploit exists; no vendor patch has been released following disclosure, as the vendor did not respond.
Integer overflow in msgpack-java's MessageUnpacker.skipValue() allows unauthenticated remote attackers to inject attacker-controlled data into deserialized fields by supplying a MAP32 container with an element count at or above 0x40000000. When the parser multiplies this count by 2 to traverse key-value pairs, the 32-bit result wraps, causing the cursor to halt prematurely and subsequent field reads to draw from attacker-supplied bytes rather than legitimate data. No vendor-released patch has been identified in available references; the issue is tracked at GitHub issue #1014 and disclosed by VulnCheck.
Stack overflow denial-of-service in msgpack-java through 0.9.12 allows unauthenticated remote attackers to crash individual deserialization requests by sending crafted payloads containing deeply nested MessagePack arrays or maps. The root cause is unbounded recursion in `MessageUnpacker.unpackValue()` (lines 646-664), which processes nested structures without any depth limit, exhausting the JVM thread stack and throwing an unhandled `StackOverflowError`. No public exploit or active exploitation has been identified; impact is limited to per-request availability disruption rather than full service termination.
NoSQL injection in the GridFS component of the MongoDB Java Driver allows an authenticated low-privilege user who can influence the file identifier passed by an affected application to break out of the intended document scope. By supplying a structured identifier containing MongoDB query operators instead of a literal file ID, the attacker can read file chunks belonging to other owners, delete all file chunks in the affected GridFS bucket (rendering stored content permanently unreadable), or rename an arbitrary stored file rather than the intended target. No public exploit code or CISA KEV entry has been identified at time of analysis, and exploitation requires a specific application code pattern that forwards user-controlled input directly to GridFS operations without sanitization.
Denial of service in Apache ActiveMQ Artemis and Apache Artemis message brokers allows authenticated clients holding MANAGE permission to crash broker processing threads by submitting crafted management-via-messaging requests that trigger unsafe Java deserialization. The deserializer processes method parameters the broker never actually uses, permitting gadget-chain payloads that consume excessive CPU and pin the thread pool. Both the legacy ActiveMQ Artemis lineage (1.3.0-2.44.0) and the newer Apache Artemis project (2.50.0-2.56.0) are affected; no public exploit or active exploitation has been identified at time of analysis.
Sensitive credential material - including authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions - was written to diagnostic log files across six Snowflake client drivers (Python, Go, JDBC, Node.js, PHP PDO, and ODBC) due to incomplete log-redaction coverage. An attacker with read access to the log destination, whether a local filesystem, a log aggregation pipeline, or a CI/CD artifact store, can extract valid credentials and decryption keys. Exploitation impact is bounded by credential lifetime and object scope, but successful use of harvested tokens provides authenticated access to the corresponding Snowflake account or cloud-storage objects. No public exploit is identified at time of analysis; vendor-released patches are available for all six drivers as of September 3, 2026.
Unbounded resource allocation in jackson-coreutils 2.0 exposes any Java application using the library's JSON Pointer parser to remote denial of service. The `TreePointer.tokensFromInput` method in the JSON Pointer parsing component fails to enforce limits on resource allocation when processing attacker-controlled input, allowing a remote unauthenticated attacker to trigger excessive memory or CPU consumption. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure, and no patch is available at time of analysis.
Improper access controls in java-json-tools json-patch (versions up to 1.13) allow low-privileged, network-accessible attackers to abuse the CopyOperation.apply and MoveOperation.apply methods to reference JSON document paths outside their permitted scope, enabling unauthorized data reads or writes within the processed JSON structure. The flaw resides in src/main/java/com/github/fge/jsonpatch/CopyOperation.java and affects any application that exposes JSON Patch processing to partially-trusted callers without additional server-side path validation. A public proof-of-concept exists via GitHub issue #170; no CISA KEV listing has been recorded, and the CVSS 4.0 score of 5.3 reflects the limited C/I impact and mandatory low-privilege prerequisite.
Uncontrolled resource consumption in java-json-tools jackson-coreutils 2.0 allows remote unauthenticated attackers to trigger a denial-of-service condition by submitting crafted input that causes BigDecimal.toPlainString() in JacksonUtils.java to exhaust CPU or memory resources. The root cause is CWE-400 (Uncontrolled Resource Consumption), a well-understood class of vulnerability in Java BigDecimal handling where specially constructed numeric values - such as those with extremely large scale or unscaled value - produce pathologically long string representations. No public exploit has been incorporated into the CISA KEV catalog, though exploit code was publicly disclosed via a GitHub issue report. The maintainer has not responded to responsible disclosure.
Server-side request forgery in jackson-coreutils 2.0 allows remote unauthenticated attackers to manipulate the server into issuing arbitrary outbound HTTP requests by supplying a crafted URL to the JsonLoader.fromURL function. The vulnerability originates from insufficient URL validation in the library's JSON loading component, enabling internal network probing, access to cloud metadata endpoints, or interaction with internal services not otherwise reachable. A public proof-of-concept exists via the project's GitHub issue tracker, and the maintainer has not responded to the disclosure; no patch is available at time of analysis.
Uncontrolled resource consumption in java-json-tools json-patch up to version 1.13 allows remote unauthenticated attackers to trigger service degradation by sending crafted JSON Patch documents to the JsonPatch.apply() handler. The vulnerability resides in the Patch Operation Handler component and carries no confidentiality or integrity impact - purely availability. A public proof-of-concept has been disclosed via a GitHub issue report, though no KEV listing indicates active exploitation at this time.
SQL identifier injection in jaychouchannel's Tourism-Management-System allows remote unauthenticated attackers to enumerate arbitrary database tables and columns by manipulating the `tableName` and `columnName` URL path parameters accepted by multiple endpoints in `CommonController.java`. All commits up to 8122bf020d91199eddfff3ee02d1632a70a9a132 are affected, and exploit code has been publicly disclosed via VulDB. A fix commit (d44ec3aa) is available, introducing a dedicated `SqlIdentifierValidator` to whitelist valid SQL identifiers across the affected controller.
SQL injection in jaychouchannel's Tourism-Management-System (Java Spring Boot, up to commit 8122bf02) allows unauthenticated remote attackers to manipulate SQL queries by injecting payloads into table, column, xColumn, or yColumn path variables accepted by multiple CommonController endpoints backed by CommonDao. Successful exploitation yields limited data disclosure and modification across the application database. A public proof-of-concept is available via GitHub issue #7, and a patch has been merged as commit d44ec3aa via PR #14.
Missing authorization in projeto-siga Siga's authentication controller allows unauthenticated remote attackers to bypass access controls by manipulating the `cod` or `jwt` parameters submitted to the `ExAutenticacaoController.autenticar` function. Versions up to 11.0.2.10, 11.0.2.13, and 11.1.1 of this Brazilian judicial document management platform are affected. A proof-of-concept exploit has been publicly disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure at time of analysis.
Server-side request forgery in projeto-siga SIGA up to version 11.1.1 allows unauthenticated remote attackers to cause the application server to issue arbitrary HTTP requests by supplying a crafted value to the html parameter of the HTML-to-PDF conversion endpoint (ExUtilController.java, DownloadExterno.getUrl). This enables attackers to probe internal network services, exfiltrate cloud metadata, or reach otherwise-inaccessible infrastructure through the server's outbound network position. A public exploit exists and the maintainer has not responded to the responsible disclosure issue (#2492), leaving all deployments on 11.1.1 and earlier unpatched.
Reflected cross-site scripting in sfturing ssm_pro's OrderController allows unauthenticated remote attackers to inject arbitrary JavaScript via the hospitalName, officesName, or doctorName parameters of the Order Endpoint. The affected codebase (up to commit 627f426331da8086ce8fff2017d65b1ddef384f8) is a Java-based hospital order management system that fails to sanitize user-supplied input before rendering it in the browser. An exploit has been published and is publicly available; the project maintainer has not yet responded to the disclosure despite being notified via a GitHub issue report.
Authorization bypass in sfturing hosp_order exposes its order cancellation endpoint to manipulation of the ID parameter, allowing an attacker to cancel medical orders belonging to any patient without owning those records (CWE-639 IDOR). The vulnerable function is orderRecordsService.cancelOrder in OrderController.java within this Java/SSM-stack hospital management application. A public exploit is documented in GitHub issue #116; the project maintainer has not responded to the disclosure, leaving no remediated version available.
Authorization bypass in sfturing hosp_order allows unauthenticated remote attackers to modify hospital order records belonging to arbitrary users by supplying attacker-controlled `userID` or `id` parameters to the `updateOrderSta1` and `updateOrderdiseaseInfo` endpoints in OrderController.java. A public proof-of-concept exploit was disclosed via GitHub issue #115; the maintainer has not responded to the report. The project follows a rolling release strategy, making version-pinned remediation guidance impossible - all commits through 627f426331da8086ce8fff2017d65b1ddef384f8 are confirmed affected.
Authorization bypass through user-controlled key (IDOR, CWE-639) in sfturing hosp_order's OrderController allows unauthenticated remote attackers to access or manipulate hospital order records belonging to arbitrary users by supplying a crafted `userIdenf` parameter. The affected codebase is a Java Spring-based hospital order management system, and the vulnerability is exposed via the `/ssm_pro` web application endpoint. A public proof-of-concept exists via GitHub issue #114; the maintainer has not responded to the disclosure, and no patch has been released.
Unverified password change in sfturing hosp_order allows unauthenticated remote attackers to arbitrarily modify any user's password through the `modifyPassWord` function in `CommonUserController.java`. The Password Recovery component fails to validate the requester's identity or current credentials before accepting a new password, enabling full account takeover without prior authentication. A public exploit has been released via the project's GitHub issue tracker, and the vendor has not responded to the disclosure.
Certificate revocation bypass in mwiede jsch through version 2.28.5 allows unauthenticated remote attackers to have a revoked SSH host certificate accepted as trusted during host verification. The `setKnownHosts()` parser in `KnownHosts.java` failed to recognize OpenSSH certificate key types (e.g., `ssh-ed25519-cert-v01@openssh.com`) as valid when paired with the `@revoked` marker, causing such entries to be skipped rather than tracked in the revocation pool - silently nullifying the revocation check. A public proof-of-concept is available via GitHub issue #1091, and the fix is released as version 2.28.6.
Improper access control in JeecgBoot's AI-RAG module (versions up to 3.9.3) permits a low-privileged authenticated user to invoke the exportXls endpoint in AiragModelController.java and extract LLM model credentials by manipulating the credential parameter beyond their authorization level. The attack is network-accessible and requires only a valid low-privileged session with no administrative rights. A public proof-of-concept is available via GitHub issue #9600, and a vendor patch has been released in version 3.9.5.
Unauthenticated access to the first-run Super-Admin bootstrap endpoint (/api/v1/bootstrap/setup) and all 17 admin/DPO console pages in tsi-coop tsi-dpdp-cms ≤0.5.0 allows remote attackers to claim full administrative control of any fresh or reset deployment and to retrieve page source containing internal API endpoints, function names, and request schemas. The root cause is CWE-306: console pages relied solely on client-side JavaScript redirects with no server-side session gate, and the bootstrap endpoint imposed no token or expiry requirement. A publicly available proof-of-concept exploit exists on GitHub; the vendor has released v0.5.1 which adds server-side session enforcement and a required deployment token.
Unauthenticated network attackers can elicit Java stack traces from Red Hat IdM's Dogtag CA REST enrollment endpoint (POST /ca/rest/certrequests) by submitting malformed requests, causing HTTP 500 responses that expose internal implementation details under CWE-209. The same error path simultaneously amplifies the CA debug log with large multi-line stack traces, creating a log-fill resource exhaustion vector that drives disk growth and I/O contention on affected RHEL 6 through 10 deployments. No public exploit has been identified at time of analysis, but the attack requires no authentication and low complexity, making it accessible to unskilled opportunistic attackers targeting IdM infrastructure.
Server-side request forgery in PowerJob up to version 5.1.2 allows unauthenticated remote attackers to issue arbitrary server-originated requests via the MuConnectionManager.getOrCreateConnection function exposed through the Transport Endpoint in TestController.java. Publicly available exploit code exists (confirmed by CVSS 4.0 E:P modifier and description), and no vendor patch is available - the project was notified via GitHub issue but has not responded. Successful exploitation can be used to probe internal services, access cloud instance metadata endpoints, or exfiltrate credentials from the server's internal network.
Unrestricted file upload in jeecgboot jeewx-boot's doUpload endpoint exposes the server to arbitrary file write via manipulation of the File argument in MyJwWebJwid3Controller, within the WeChat integration module. The vulnerability stems from improper access control (CWE-284) and public exploit code has been disclosed (CVSS 4.0 E:P), though the project maintainer has not yet responded to the issue report. The rolling-release development model means no fixed version can be cited, leaving all deployments at the affected commit hash and earlier without vendor guidance.
Authorization bypass in Soarkey StudentManagement (学生信息管理系统) exposes administrative functions to unauthenticated remote attackers by allowing manipulation of the `action` parameter in the Administrative Servlet's `AdminDao.doGet()` handler. The CVSS 4.0 vector confirms PR:N - no credentials required - and a public proof-of-concept exploit exists via GitHub issue #32. The project maintainer was notified but has not responded, leaving the vulnerability unpatched across all known versions through commit e08f7f1d.
Uncontrolled recursion in BBEdit's Java Language Module (versions through 15.5.5) allows a remote attacker to crash or hang the editor by delivering a specially crafted Java source file that a user then opens. The root cause is CWE-674: the Java parser lacks depth-limiting guards, enabling deeply nested constructs to exhaust the call stack and produce a denial-of-service against the editor process. No active exploitation has been recorded and no public proof-of-concept exploit code is known; the issue was surfaced through fuzzing research by Cipher Security Labs, and Bare Bones Software has released a fix in BBEdit 16.0.
Improper authorization in LogNet's grpc-spring-boot-starter affects annotation processing logic in versions up to 5.2.0, allowing authenticated remote attackers with low privileges to bypass access controls under high-complexity conditions. The vulnerability stems from CWE-266 (Incorrect Privilege Assignment) in the component responsible for processing security annotations on gRPC service endpoints. A proof-of-concept exploit has been publicly disclosed; no vendor patch is available as the project has not yet responded to the responsible disclosure report.
Memory corruption in LatencyUtils 2.0.3 and earlier allows a local low-privileged user to cause availability disruption by manipulating input to the `LatencyStats.recordDetectedPause` function in the PauseDetector component. A public proof-of-concept has been disclosed via a GitHub issue, and the project maintainers have not responded to the disclosure, leaving the library without an upstream fix. The CVSS 4.0 score of 1.9 and availability-only impact (VA:L) reflect a tightly scoped, low-severity flaw with no confidentiality or integrity consequences and no confirmed active exploitation.
Charset-confusion in MariaDB Connector/J (all branches prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows a server-side character set change mid-session to silently decouple the driver's UTF-8 encoding assumption from the server's active encoding. Because the driver continues escaping SQL string literals as UTF-8 while the server parses incoming bytes under a different multi-byte encoding (e.g., GBK or BIG5), the mismatch can defeat byte-wise SQL quoting and enable SQL injection - a well-documented attack class for charset-confusion primitives. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis.
MariaDB Connector/J exposes database account passwords in cleartext to on-path attackers or hostile servers when PAM (dialog) authentication is used over plain TCP. The driver's PAM handler (SendPamAuthPacketFactory, plugin name 'dialog') failed to override the requireSsl() gate that correctly protects its sibling mysql_clear_password plugin, inheriting a default value of false and thus omitting the secure-transport requirement. Under the default connector configuration (sslMode=DISABLE, restrictedAuth=null), a man-in-the-middle or rogue server can issue an Authentication Switch Request for the dialog plugin and receive the account password in cleartext, granting full credential reuse against the real database. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack mechanics are straightforward for any on-path attacker against affected deployments.
Cleartext database password disclosure in MariaDB Connector/J (all versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows an active network man-in-the-middle to capture a victim application's full database password during the initial TLS handshake. The connector's initial-handshake code path transmits a mysql_clear_password authentication response before validating the certificate fingerprint that is supposed to enforce server identity - a guard that the OK-packet and auth-switch paths correctly enforce but that HandshakeResponse.encode() bypasses entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the vulnerability mechanism is fully documented in a vendor-published HackerOne report and GHSA advisory.
Unauthorized token deletion in Graylog's REST API (versions 6.2.0 through 6.3.11, 7.0.0-7.0.6, and 7.1.0-7.1.1) allows any authenticated user to revoke access tokens belonging to other accounts - including administrators and service accounts - by exploiting a misplaced permission check in the token revocation endpoint. The flaw does not expose token secret values but can invalidate privileged credentials and disrupt automated integrations that rely on access tokens. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 6.3.12, 7.0.7, and 7.1.2.
Reflected XSS in Yamcs versions through 5.8.6 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a logged-in user's browser by delivering a specially crafted URL targeting the OAuth authorization endpoint. Exploitation exfiltrates the victim's session and refresh tokens to an attacker-controlled server, enabling complete account takeover. No public exploit identified at time of analysis independent of the advisory, though GHSA-rxpg-wjf8-qv9c includes a working reproduction payload with exact URL and netcat listener steps; vendor patch is available in 5.9.4 (CVSS 6.5, UI:R).
Missing authorization checks on three IAM REST API endpoints in Yamcs allow any authenticated low-privilege user to enumerate the server's complete privilege taxonomy and role-to-privilege mappings, directly enabling targeted privilege escalation reconnaissance. Affected are yamcs-core versions up to 5.12.7 and 5.13.0 through 5.13.1, used in production spacecraft operations and ground station environments. A proof-of-concept is confirmed in the GHSA advisory; no active exploitation (CISA KEV) has been identified, but the leaked data (including the ControlAccess and ChangeMissionDatabase privilege names) provides a precise roadmap for chained attacks including, per the advisory, algorithm-level remote code execution.
Unauthenticated access to Spring Boot Actuator management endpoints in Zipkin through 3.6.1 exposes sensitive operational data and configuration controls on the same port as the tracing API. Remote attackers with network reach to the Zipkin API port can read environment variables, bean configurations, and storage backend credentials via endpoints such as /actuator/env and /actuator/beans, or silently suppress security-relevant logging by modifying log levels via /actuator/loggers. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated remote exploitation; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unsafe header deserialization in Spring Integration's EmbeddedHeadersJsonMessageMapper exposes applications to header injection across all active release trains (5.5.x through 7.1.0). The decodeNativeFormat method constructs GenericMessage objects with MutableMessageHeaders populated directly from attacker-controlled JSON-deserialized header maps, bypassing sanitization by default in the constructor. Low-privileged network attackers who can submit crafted byte payloads to an affected consumer channel can manipulate message headers, yielding partial confidentiality, integrity, and availability impacts. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV.
Concurrent message processing in Spring Integration's script-backed channels causes shared ScriptEngine state corruption when using JSR-223 engines that declare THREADING=null, such as the Kotlin KTS engine. Affected Spring Integration versions from 5.5.21 and earlier through 7.1.0 are susceptible to cross-message data leakage, where one message's payload or header bindings can bleed into another message's script evaluation context under concurrent load. No public exploit has been identified at time of analysis, and the CVSS 4.2 Medium rating reflects the high attack complexity imposed by the required race condition, though the information disclosure and partial integrity impact are real concerns in multi-tenant or high-throughput deployments.
Link credit exhaustion in Spring AMQP 4.1.0 silently stalls AMQP listener containers when a container-level ErrorHandler is active. Each message delivery whose processing throws an exception permanently consumes one link credit without returning it to the broker; once the pool reaches zero (after the default 100 credits), the broker halts delivery while isRunning() continues to report true, masking the outage from standard health checks. No active exploitation has been confirmed (no CISA KEV listing, no public POC), but this is a realistic denial-of-service condition for any Spring-based messaging consumer running the affected version with an ErrorHandler configured.
RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.
Denial-of-service in Spring for Apache Kafka's `DeadLetterPublishingRecovererFactory` exposes consumer JVMs across all supported branches (2.8.x through 4.1.0) to crash or hang when processing messages with a crafted `retry_topic-original-timestamp` header. An authenticated Kafka producer can inject a ConsumerRecord carrying an oversized or malformed header byte array, which is passed without any length or format validation directly to Java's `BigInteger(byte[])` constructor, triggering heap memory exhaustion or an unhandled exception that disrupts message consumption. No public exploit code has been identified and the CVE does not appear in CISA KEV at time of analysis, but low attack complexity combined with broad version coverage makes this a credible availability threat for any Spring Kafka deployment using retry or dead-letter queue features.
Denial of Service in Spring Cloud Config's Monitor component allows unauthenticated remote attackers to crash or degrade the configuration server by submitting malicious payloads to the webhook endpoint. Affected versions span the 3.x, 4.x, and 5.x release lines, covering a broad installed base of Spring Boot microservice environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated network-accessible attack surface (PR:N, AV:N, AC:L) means exploitation requires minimal capability.
HTTP response splitting in Spring Framework affects applications that construct Content-Disposition HTTP headers by concatenating untrusted user-supplied file names without stripping CRLF characters, allowing remote attackers to inject arbitrary headers into HTTP responses. The vulnerability spans the entire actively-maintained Spring Framework lineage - versions 5.2.x through 7.0.8 - giving it a broad potential surface across Java enterprise application portfolios. No public exploit is identified at time of analysis, and EPSS at 0.16% (6th percentile) indicates low current exploitation probability.
Symlink redirection in Spring Integration's Zip/UnZip transformer allows a local unprivileged user sharing the same host to hijack transformer output by pre-creating /tmp/ziptransformer as a symlink before application startup. Affected versions span the 6.4, 6.5, 7.0, and 7.1 release lines, covering a wide range of enterprise Java deployments that use Spring Integration's file transformation capabilities. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the integrity and availability impact is rated High by the vendor-assigned CVSS score.
Spring Cloud Stream versions 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6 expose a deserialization of untrusted types flaw that could allow a network-positioned attacker with high privileges and required user interaction to gain limited read and write access to application data. The CVSS vector (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) reflects heavy exploitation constraints, making real-world abuse unlikely without insider-level access and specific preconditions. No public exploit code has been identified and the vulnerability is absent from CISA KEV at time of analysis.
Spring Cloud Stream's partition interceptor logic improperly inserts a partition interceptor during message sends under specific conditions, potentially routing messages to unintended partitions. Affected versions span three active release lines: 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6. An authenticated operator with high privileges who triggers a message send under the required conditions could cause limited information disclosure or message integrity degradation by routing data to an unintended partition consumer. No public exploit identified at time of analysis; CVSS score of 3.1 reflects the high access bar and narrow impact.
Improper content-type caching in the Avro component of Spring Cloud Stream can produce incorrect content-type metadata on processed messages, creating a low-severity information-disclosure and data-integrity risk. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release trains. Exploitation requires network access, high privilege level, high attack complexity, and user interaction, making real-world impact minimal; no public exploit code or active exploitation has been identified at time of analysis.
Spring Cloud Stream's dynamic destination cache lacks an upper bound on its size, exposing applications to limited information disclosure and integrity concerns under constrained conditions. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release lines, reported by VMware (Broadcom), the Spring project maintainer. No public exploit code exists and the vulnerability is not listed in CISA KEV; the low CVSS score of 3.1 reflects the highly constrained exploitation prerequisites including high privilege requirements and user interaction.
Sensitive data exposure in Spring Cloud Stream versions 4.2.0-4.2.6, 4.3.0-4.3.3, and 5.0.0-5.0.2 allows logging of sensitive information - such as message payloads, headers, or configuration values - under specific conditions. The vulnerability is classified as information disclosure with a low CVSS base score of 3.1, reflecting the high attack complexity and privilege requirements. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Spring Cloud Function's Azure integration may inadvertently log sensitive data across three affected release lines (4.2.0-4.2.7, 4.3.0-4.3.4, 5.0.0-5.0.3), resulting in low-impact information disclosure. The vulnerability is constrained by a high-privilege, high-complexity, user-interaction-required exploitation profile (CVSS 3.1), making it a low-priority issue for most organizations. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog; the primary risk is credential or token leakage through application log aggregators accessible to operators or compromised log pipelines.
Spring Cloud Function's AWS adapter component may inadvertently write sensitive data to application logs, creating an information disclosure exposure across a wide range of maintained version branches (3.x through 5.x). The CVSS score of 3.1 reflects genuinely low severity - exploitation requires high privileges and high attack complexity - but the risk in regulated or multi-tenant environments is elevated if log stores are accessible to unauthorized parties or if sensitive data (credentials, payloads, tokens) persists in cloud-native logging services such as AWS CloudWatch. No public exploit code exists and no active exploitation has been identified at time of analysis.
Spring Cloud Function's composition lookup mechanism can be abused by a highly privileged attacker to poison the base function, potentially degrading the integrity and confidentiality of function execution across versions 3.2.16 and earlier through 5.0.3. The vendor-assigned CVSS base score of 3.1 reflects severely constrained exploitation prerequisites - high privilege level, high attack complexity, and required user interaction - substantially limiting realistic exposure. No public exploit code has been identified, and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
HTTP header filtering deficiency in Spring Cloud Function versions 5.0.0-5.0.3, 4.3.0-4.3.4, 4.2.0-4.2.7, and 3.2.16 and earlier allows network-accessible authenticated attackers - under high-complexity conditions and requiring user interaction - to achieve limited confidentiality and integrity impacts via crafted HTTP headers. Reported by VMware, the flaw scores 3.1 (Low) under CVSS 3.1, with multiple compounding prerequisites that substantially restrict real-world exploitability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Spring Cloud Function's ServerlessHttpServletRequest.isSecure() method returns an unchecked result that does not reflect the actual HTTP transport scheme, enabling applications that gate security decisions on this call to behave incorrectly. Affected versions span three active release lines: 5.0.0-5.0.3, 4.3.0-4.3.4, and 4.2.0-4.2.7. No public exploit code exists and the vulnerability is not listed in CISA KEV; the vendor-assigned CVSS of 3.1 (Low) reflects constrained exploitation prerequisites including high privilege and user interaction.
Path traversal in Spring AI's ResourceCacheService allows an authenticated low-privileged network attacker to write files outside the intended cache directory. The getCacheName() method appends URI fragments verbatim - including '../' sequences and path separators - to a base directory path before passing the result to new File(resourceParentFolder, newFileName) and writing downloaded bytes there. Affected versions span Spring AI 1.0.9 and earlier, 1.1.0 through 1.1.8, and 2.0.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Spring Integration's jCIFS-based SMB client silently negotiates down to legacy SMB1/CIFS when applications omit an explicit `smbMinVersion` setting, exposing file transfer sessions to NTLM relay attacks and in-transit content tampering by a network-positioned adversary. Affected versions span Spring Integration 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, and the standalone release 7.1.0 - covering all currently active Spring Integration release trains at time of disclosure. No CISA KEV listing or public exploit code specific to this CVE has been identified at time of analysis, though NTLM relay is a mature, extensively tooled attack class; EPSS data was not available in the sourced intelligence.
Spring Integration's default file-based metadata store writes persistent state to a world-readable file under java.io.tmpdir, exposing integration metadata to any local OS user on the affected host. All actively maintained branches are affected, spanning versions 5.5.21 and earlier through 7.1.0. No public exploit code or active exploitation has been identified at time of analysis; practical impact is limited to local confidentiality disclosure on shared or multi-user systems.
Spring Cloud Function versions across three actively maintained release lines (4.2.x, 4.3.x, and 5.0.x) are affected by a potential arbitrary file read and SSRF vulnerability reported by VMware. The vendor-assigned CVSS 3.1 score of 2.0 reflects severe constraints on exploitability - high privilege requirements (PR:H), required user interaction (UI:R), and high attack complexity (AC:H) together make opportunistic or unauthenticated exploitation implausible. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
Resource exhaustion in Spring for GraphQL's WebSocket client allows unauthenticated remote attackers to trigger a Denial of Service when the keepAlive feature is enabled. Three release trains are affected: 1.3.x through 1.3.9, 1.4.x through 1.4.6, and 2.0.x through 2.0.4, as confirmed by the VMware/Spring vendor advisory. No public exploit code has been identified and EPSS at 0.15% (4th percentile) indicates low near-term exploitation probability, though the lack of authentication requirement warrants patching for any deployment exposing WebSocket endpoints to untrusted networks.
Reflected XSS in Spring Framework's MVC and WebFlux data-binding error rendering exposes users of vulnerable applications to arbitrary HTML and JavaScript injection. All active Spring Framework release trains are affected - versions 5.2.x through 7.0.8 - making the exposure surface extremely broad across enterprise Java deployments. An unauthenticated attacker (per CVSS PR:N) can craft a malicious URL containing injected script payloads that, when a victim clicks it, execute in the victim's browser context via reflected field-error output. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating limited observed exploitation activity at time of analysis.
Spring Security 7.1.0's InetAddressMatchers utility contains a flaw in its IP address classification logic - the matchInternal() and matchExternal() builders may incorrectly categorize certain IP addresses as belonging to internal or external networks, enabling unauthenticated remote attackers to bypass IP-based access controls under high-complexity conditions. Applications that rely on InetAddressMatchers to enforce network-level access restrictions are exposed to limited information disclosure where restricted endpoints or data may become accessible to external parties. No public exploit code exists and no CISA KEV listing is present, indicating no confirmed active exploitation at time of analysis.
Timing side-channel exposure in Spring Security allows remote unauthenticated attackers to progressively infer security-sensitive string values - such as CSRF tokens, bearer tokens, or other secrets compared at the application layer - by statistically measuring the time differential between rejection responses. Multiple active Spring Security release trains are affected, spanning versions 5.7.x through 7.1.x, representing a broad swath of production Spring-based Java applications. No public exploit code has been identified at time of analysis, and CISA KEV status is absent; however, the confidentiality impact is rated High in the CVSS vector, reflecting that successful exploitation could fully compromise protected secrets under favorable network conditions.
Incomplete NAT64 prefix filtering in CC: Tweaked prior to 1.120.0 allows any Lua-capable Minecraft player on a dual-stack server to bypass SSRF protections and reach loopback, RFC 1918, cloud metadata, or internal API endpoints. The flaw resides in AddressPredicate.java, which correctly blocks the RFC 6052 Well-Known NAT64 prefix (64:ff9b::/96) but omits the RFC 8215 Local-Use prefix (64:ff9b:1::/48), enabling requests via http.request or http.websocket to mapped internal IPv4 addresses. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation requires a non-default dual-stack NAT64 deployment.
Path traversal in Spring Framework's FreeMarker integration allows authenticated remote attackers to read arbitrary files from the server's template path when a controller passes user-controlled input directly as a view name. Affected versions span every maintained Spring Framework branch from 5.2.x through 7.0.8, making the exposure broad in the Java ecosystem. No public exploit code or active exploitation has been identified; CISA's SSVC assessment rates technical impact as partial and the vulnerability as non-automatable, consistent with the configuration dependency required to trigger it.
TLS certificate validation is absent by default in Spring AMQP's Log4j2 appender when shipping log events to a RabbitMQ broker, leaving all log traffic fully exposed to man-in-the-middle interception. Spring AMQP versions 2.4.18 and earlier, 3.2.0-3.2.12, 4.0.0-4.0.4, and 4.1.0 are affected when the Log4j2 appender is used with its documented default configuration. No public exploit has been identified at time of analysis, but the high confidentiality and integrity CVSS impact reflects that intercepted log streams may contain API keys, session tokens, and other sensitive application data.
Open redirect in Spring Authorization Server 1.5.0-1.5.7 allows remote unauthenticated attackers to redirect victims to attacker-controlled sites by crafting authorization requests that pair an invalid request_uri with an unvalidated redirect_uri. The CVSS scope change (S:C) reflects that the redirect escapes the authorization server's security boundary, enabling high-trust phishing attacks because victims see the legitimate authorization server domain before being redirected. No public exploit has been identified at time of analysis, and exploitation requires user interaction.
Header type injection in Spring for Apache Kafka's default mapper configuration allows any Kafka producer with access to a consumed topic to inject java.net.InetAddress objects through the spring_json_header_types message header, triggering DNS resolution on the consumer host. All applications using @KafkaListener with the default JsonKafkaHeaderMapper or DefaultKafkaHeaderMapper - spanning versions 2.8.x through 4.1.0 - are affected without any non-default configuration required. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Denial-of-service in Spring AMQP across multiple supported release lines allows a privileged AMQP publisher to force a System.exit(99) call inside the consumer JVM, killing the entire process rather than isolating the failure to the listener thread. Affected versions span the 2.4.x, 3.2.x, 4.0.x, and 4.1.0 release trains, covering a wide swath of actively maintained Spring deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total, immediate JVM termination and the collateral impact on every co-located workload make this operationally significant in RabbitMQ-integrated Spring environments.
Spring Integration's UnZipTransformer component fails to impose any limit on decompressed entry size or entry count, enabling a low-privileged remote attacker to trigger JVM heap exhaustion via a crafted zip bomb archive. Affected versions span 6.4.0-6.4.12, 6.5.0-6.5.10, and 7.0.0-7.1.0 across the widely-used Spring enterprise Java framework. The attack primitive is well-understood and trivially constructable, though exploitation requires access to an integration endpoint that routes payloads through UnZipTransformer; no public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Cleartext credential exposure in Spring AMQP affects applications that use the RabbitMQ management aliveness check: when that check fails at runtime, the configured admin password is embedded verbatim in the thrown Java exception message, making it visible to anyone with access to exception output. The vulnerability spans multiple major release lines - 2.4.x, 3.2.x, and 4.0.x through 4.1.0 - and was reported by security@vmware.com, the Spring Security team. No public exploit code has been identified at time of analysis and CISA KEV status is unconfirmed, but a successful credential leak would yield full RabbitMQ administrative control.
Open redirect in Spring Framework's UrlFileNameViewController exposes users of affected Spring MVC applications to phishing and credential-harvesting attacks across all active Spring Framework release trains (5.2.x through 7.0.x). The flaw allows an unauthenticated attacker to craft a URL that causes the vulnerable application to redirect victims to an arbitrary external domain, exploiting the controller's path-to-view-name resolution when end-of-path mapping is used without a configured prefix. No active exploitation has been confirmed - EPSS sits at 0.14% (4th percentile) and CISA SSVC reports exploitation status as none, making this a targeted patching priority rather than an emergency.
Open redirect in Spring Framework's UrlHandlerFilter allows unauthenticated remote attackers to silently redirect authenticated users to attacker-controlled URLs. Affected are Spring Framework 7.0.0-7.0.8 and 6.2.0-6.2.19 in both Spring MVC and Spring WebFlux deployments where UrlHandlerFilter is configured with broadly matching URL patterns. No public exploit code exists and SSVC indicates no known active exploitation; however, the no-privilege, network-reachable attack vector makes this a credible phishing enabler in affected applications. EPSS sits at 0.15% (5th percentile), consistent with low-automated-exploitation likelihood.
Spring Integration JMS inbound components copy inbound JMS message properties verbatim into Spring MessageHeaders without filtering reserved internal header names, enabling any authorized JMS producer to inject routing and type-resolution headers. All supported release lines are affected - from 5.5.21 and earlier through the current 7.1.0 - making this a broad exposure across enterprise Java integration deployments. No public exploit has been identified at time of analysis; however, injection of the json__TypeId__ header may interact with Jackson polymorphic deserialization if enabled, potentially elevating practical impact beyond the assigned CVSS 5.4 Medium.
Reflected cross-site scripting (XSS) in Spring Security's built-in OAuth2 Authorization Server consent page allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted authorization request URL. Affected versions include Spring Security 7.1.0 and 7.0.0 through 7.0.6; the consent page reflects user-controlled values (such as client name or scope parameters) directly into the HTML response without encoding. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog, but the changed-scope CVSS vector reflects the elevated risk of token and session theft in OAuth2 flows.
Spring Integration's UDP inbound adapter can be abused by unauthenticated remote attackers to coerce the server into emitting outbound UDP datagrams to arbitrary hosts and ports - a classic UDP Server-Side Request Forgery (SSRF). Affected versions span the entire supported line from 5.5.x through 7.1.0, covering a wide range of enterprise Java deployments. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity (single crafted UDP packet) makes this straightforward to weaponize once the adapter port is located.
Path traversal in Spring Integration's ZipTransformer allows a low-privileged attacker who controls the file_name message header to write ZIP archive output to arbitrary filesystem paths outside the configured workDirectory. Affected versions span the 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines of Spring Integration, and exploitation is viable by default since ZipResultType.FILE is the standard configuration. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Spring AMQP's optional message decompression feature allows any principal with queue publish access to crash the consumer JVM by sending a single crafted ~1 MB compressed message. Affected versions span the 2.4.x, 3.2.x, 4.0.x, and 4.1.0 release lines, making this a broad supply-chain concern for Spring-based Java messaging infrastructure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and high availability impact warrant prompt remediation in any environment where queue publish access is shared or externally reachable.
Uncontrolled memory allocation in Spring Integration's RFC6587SyslogDeserializer allows any network-reachable, low-privileged syslog sender to supply an arbitrarily large octet count, causing the TCP inbound adapter to allocate an unbounded byte array and potentially read across RFC 6587 message frame boundaries. Affected release lines span 5.5.x through 7.1.0. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the low attack complexity and low privilege requirement make exploitation straightforward for any entity permitted to deliver syslog messages to the adapter.
Unsafe deserialization in Spring Integration exposes network-accessible, low-privilege attackers to arbitrary Java class instantiation by manipulating the json__TypeId__ message header, which is resolved via ClassUtils.forName without any type or package allowlist. All maintained Spring Integration branches are affected - 5.5.21 and earlier, 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, and 7.1.0 - making the exposure broad across the Spring ecosystem. No public exploit code or CISA KEV listing has been identified at time of analysis, though the deserialization-via-header-controlled-type pattern is a well-understood Java attack class with a mature exploit toolkit.
Spring Data REST's HTTP PUT handler silently drops the persisted `@Version` field when writing immutable aggregate root types, bypassing the framework's optimistic locking mechanism. Affected release trains span versions 3.x through 5.1.0, covering a broad surface of Spring-based enterprise REST APIs that use versioned immutable entities. An authenticated low-privilege attacker can exploit this to perform lost-update attacks - overwriting entity state without triggering concurrency conflict detection - undermining data integrity guarantees in concurrent-write environments. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Denial-of-service and minor integrity impact in Oracle Java SE 7u511 allows unauthenticated remote attackers to crash or hang the JVM via the 2D graphics rendering component, exploitable across multiple network protocols with no authentication or user interaction required. The attack surface is broadened by the component's exposure through APIs consumed by web services, sandboxed Java Web Start applications, and sandboxed Java applets loading untrusted code. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the low exploitation complexity means automated scanning is feasible.
AES/CBC encryption in Spring Security's AesBytesEncryptor silently degrades to a null (all-zero) initialization vector when applications use the two-argument constructor or pass a null IV generator with CBC mode selected, completely undermining the semantic security of any data encrypted through this code path. Affected versions span Spring Security 5.7.0 through 7.1.0, covering multiple active release lines used extensively in Java and Spring Boot enterprise applications. No public exploit code has been identified at time of analysis, but the CVSS confidentiality impact is rated High and exploitation requires only low-privilege access to any application instantiating the vulnerable encryptor pattern.
Unauthenticated password reset in jaychouchannel's Tourism-Management-System allows any remote attacker to overwrite an arbitrary user's credentials by supplying only a known username to the resetPass endpoint - no current password, token, or session is required. All three Java Spring controllers (UsersController, DaoyouController, YonghuController) share the vulnerable pattern, enabling forced account lockout or, if the API response includes the newly generated random password, full account takeover. Publicly disclosed exploit code exists and the upstream fix is available via commit 9cb6215.
Unauthenticated remote attackers can register accounts with elevated (administrator) privileges in jaychouchannel Tourism-Management-System by manipulating the UsersEntity parameter during registration, bypassing role assignment controls. The commit diff reveals a broader scope than the description implies: at least 12 controller classes (ChatmessageController, multiple Discuss* controllers, ForumController, FriendController, FriendlinkController, NewsController, NewstypeController, StoreupController) had security() endpoints decorated with @IgnoreAuth, making those endpoints callable without any authentication. Publicly available exploit code exists; no active exploitation confirmed in CISA KEV.
Authorization bypass in jaychouchannel's Tourism-Management-System allows authenticated remote users to access or modify ticket order records belonging to other users by manipulating the ID parameter in CRUD operations against MenpiaodingdanController.java. This is a classic Insecure Direct Object Reference (IDOR) pattern where the application fails to verify that the requesting user owns the referenced resource. A publicly available proof-of-concept exists (GitHub issue #9), and a patch has been committed (d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86), though no versioned release is available due to the project's rolling-release approach.
Authorization bypass in jaychouchannel's Tourism-Management-System (all Java/Spring Boot commits through 84d8ec384f) allows low-privileged authenticated users to invoke protected `security()` endpoints across 12 controllers by exploiting misapplied `@IgnoreAuth` annotations that instruct the AuthorizationInterceptor to skip permission enforcement entirely. The affected endpoints span chat, discussion, forum, friend, news, and store-bookmark controllers, exposing user security data and privileged actions to callers who lack the required roles. Publicly available exploit code exists via GitHub issue #12; the vendor has released a patch commit removing the offending annotations.
SQL injection in GongShengyue OnlineBooks allows authenticated remote attackers to manipulate database queries through the `column` parameter of the listSplit interface in BooksServlet.java. The vulnerability enables partial data extraction, modification, and potential availability impact against the backend database. A public proof-of-concept exploit has been published on GitHub, raising near-term exploitation probability for any internet-exposed deployments.
Hard-coded AES encryption in dromara orion-visor up to version 2.5.7 renders all SSH private keys and host passwords stored by the application recoverable by any attacker who can access the data store. The vulnerable function `HostKeyServiceImpl.encryptKey` in the asset-service module applies a fixed, unchanging key that is embedded in the publicly available GitHub source - making the key universally known to anyone who inspects the repository. A proof-of-concept demonstrating full plaintext recovery of stored SSH credentials has been publicly disclosed, and the maintainer has not responded to the issue report.
Remote code execution in Xuxueli xxl-job up to version 3.4.2 allows authenticated low-privileged users to execute arbitrary code on the executor host via the GLUE mode Groovy script handler in GlueFactory.java. The root cause is that GroovyClassLoader.parseClass processes attacker-supplied Groovy source directly, compiling and running it without a restrictive sandbox. A public proof-of-concept exploit targeting v3.4.2 has been released on GitHub, and the vendor did not respond to the coordinated disclosure.
Improper privilege management in xxl-job admin up to version 3.4.2 exposes the `loadById` endpoint of `JobGroupController.java` to unauthorized access by low-privileged authenticated users, leaking executor group configuration data. The vulnerability resides in the admin web interface's job group management controller and allows users who should lack access to read job group details via direct endpoint calls. A public proof-of-concept exploit exists; no vendor patch has been released following disclosure, as the vendor did not respond.
Integer overflow in msgpack-java's MessageUnpacker.skipValue() allows unauthenticated remote attackers to inject attacker-controlled data into deserialized fields by supplying a MAP32 container with an element count at or above 0x40000000. When the parser multiplies this count by 2 to traverse key-value pairs, the 32-bit result wraps, causing the cursor to halt prematurely and subsequent field reads to draw from attacker-supplied bytes rather than legitimate data. No vendor-released patch has been identified in available references; the issue is tracked at GitHub issue #1014 and disclosed by VulnCheck.
Stack overflow denial-of-service in msgpack-java through 0.9.12 allows unauthenticated remote attackers to crash individual deserialization requests by sending crafted payloads containing deeply nested MessagePack arrays or maps. The root cause is unbounded recursion in `MessageUnpacker.unpackValue()` (lines 646-664), which processes nested structures without any depth limit, exhausting the JVM thread stack and throwing an unhandled `StackOverflowError`. No public exploit or active exploitation has been identified; impact is limited to per-request availability disruption rather than full service termination.
NoSQL injection in the GridFS component of the MongoDB Java Driver allows an authenticated low-privilege user who can influence the file identifier passed by an affected application to break out of the intended document scope. By supplying a structured identifier containing MongoDB query operators instead of a literal file ID, the attacker can read file chunks belonging to other owners, delete all file chunks in the affected GridFS bucket (rendering stored content permanently unreadable), or rename an arbitrary stored file rather than the intended target. No public exploit code or CISA KEV entry has been identified at time of analysis, and exploitation requires a specific application code pattern that forwards user-controlled input directly to GridFS operations without sanitization.
Denial of service in Apache ActiveMQ Artemis and Apache Artemis message brokers allows authenticated clients holding MANAGE permission to crash broker processing threads by submitting crafted management-via-messaging requests that trigger unsafe Java deserialization. The deserializer processes method parameters the broker never actually uses, permitting gadget-chain payloads that consume excessive CPU and pin the thread pool. Both the legacy ActiveMQ Artemis lineage (1.3.0-2.44.0) and the newer Apache Artemis project (2.50.0-2.56.0) are affected; no public exploit or active exploitation has been identified at time of analysis.
Sensitive credential material - including authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions - was written to diagnostic log files across six Snowflake client drivers (Python, Go, JDBC, Node.js, PHP PDO, and ODBC) due to incomplete log-redaction coverage. An attacker with read access to the log destination, whether a local filesystem, a log aggregation pipeline, or a CI/CD artifact store, can extract valid credentials and decryption keys. Exploitation impact is bounded by credential lifetime and object scope, but successful use of harvested tokens provides authenticated access to the corresponding Snowflake account or cloud-storage objects. No public exploit is identified at time of analysis; vendor-released patches are available for all six drivers as of September 3, 2026.
Unbounded resource allocation in jackson-coreutils 2.0 exposes any Java application using the library's JSON Pointer parser to remote denial of service. The `TreePointer.tokensFromInput` method in the JSON Pointer parsing component fails to enforce limits on resource allocation when processing attacker-controlled input, allowing a remote unauthenticated attacker to trigger excessive memory or CPU consumption. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure, and no patch is available at time of analysis.
Improper access controls in java-json-tools json-patch (versions up to 1.13) allow low-privileged, network-accessible attackers to abuse the CopyOperation.apply and MoveOperation.apply methods to reference JSON document paths outside their permitted scope, enabling unauthorized data reads or writes within the processed JSON structure. The flaw resides in src/main/java/com/github/fge/jsonpatch/CopyOperation.java and affects any application that exposes JSON Patch processing to partially-trusted callers without additional server-side path validation. A public proof-of-concept exists via GitHub issue #170; no CISA KEV listing has been recorded, and the CVSS 4.0 score of 5.3 reflects the limited C/I impact and mandatory low-privilege prerequisite.
Uncontrolled resource consumption in java-json-tools jackson-coreutils 2.0 allows remote unauthenticated attackers to trigger a denial-of-service condition by submitting crafted input that causes BigDecimal.toPlainString() in JacksonUtils.java to exhaust CPU or memory resources. The root cause is CWE-400 (Uncontrolled Resource Consumption), a well-understood class of vulnerability in Java BigDecimal handling where specially constructed numeric values - such as those with extremely large scale or unscaled value - produce pathologically long string representations. No public exploit has been incorporated into the CISA KEV catalog, though exploit code was publicly disclosed via a GitHub issue report. The maintainer has not responded to responsible disclosure.
Server-side request forgery in jackson-coreutils 2.0 allows remote unauthenticated attackers to manipulate the server into issuing arbitrary outbound HTTP requests by supplying a crafted URL to the JsonLoader.fromURL function. The vulnerability originates from insufficient URL validation in the library's JSON loading component, enabling internal network probing, access to cloud metadata endpoints, or interaction with internal services not otherwise reachable. A public proof-of-concept exists via the project's GitHub issue tracker, and the maintainer has not responded to the disclosure; no patch is available at time of analysis.
Uncontrolled resource consumption in java-json-tools json-patch up to version 1.13 allows remote unauthenticated attackers to trigger service degradation by sending crafted JSON Patch documents to the JsonPatch.apply() handler. The vulnerability resides in the Patch Operation Handler component and carries no confidentiality or integrity impact - purely availability. A public proof-of-concept has been disclosed via a GitHub issue report, though no KEV listing indicates active exploitation at this time.
SQL identifier injection in jaychouchannel's Tourism-Management-System allows remote unauthenticated attackers to enumerate arbitrary database tables and columns by manipulating the `tableName` and `columnName` URL path parameters accepted by multiple endpoints in `CommonController.java`. All commits up to 8122bf020d91199eddfff3ee02d1632a70a9a132 are affected, and exploit code has been publicly disclosed via VulDB. A fix commit (d44ec3aa) is available, introducing a dedicated `SqlIdentifierValidator` to whitelist valid SQL identifiers across the affected controller.
SQL injection in jaychouchannel's Tourism-Management-System (Java Spring Boot, up to commit 8122bf02) allows unauthenticated remote attackers to manipulate SQL queries by injecting payloads into table, column, xColumn, or yColumn path variables accepted by multiple CommonController endpoints backed by CommonDao. Successful exploitation yields limited data disclosure and modification across the application database. A public proof-of-concept is available via GitHub issue #7, and a patch has been merged as commit d44ec3aa via PR #14.
Missing authorization in projeto-siga Siga's authentication controller allows unauthenticated remote attackers to bypass access controls by manipulating the `cod` or `jwt` parameters submitted to the `ExAutenticacaoController.autenticar` function. Versions up to 11.0.2.10, 11.0.2.13, and 11.1.1 of this Brazilian judicial document management platform are affected. A proof-of-concept exploit has been publicly disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure at time of analysis.
Server-side request forgery in projeto-siga SIGA up to version 11.1.1 allows unauthenticated remote attackers to cause the application server to issue arbitrary HTTP requests by supplying a crafted value to the html parameter of the HTML-to-PDF conversion endpoint (ExUtilController.java, DownloadExterno.getUrl). This enables attackers to probe internal network services, exfiltrate cloud metadata, or reach otherwise-inaccessible infrastructure through the server's outbound network position. A public exploit exists and the maintainer has not responded to the responsible disclosure issue (#2492), leaving all deployments on 11.1.1 and earlier unpatched.
Reflected cross-site scripting in sfturing ssm_pro's OrderController allows unauthenticated remote attackers to inject arbitrary JavaScript via the hospitalName, officesName, or doctorName parameters of the Order Endpoint. The affected codebase (up to commit 627f426331da8086ce8fff2017d65b1ddef384f8) is a Java-based hospital order management system that fails to sanitize user-supplied input before rendering it in the browser. An exploit has been published and is publicly available; the project maintainer has not yet responded to the disclosure despite being notified via a GitHub issue report.
Authorization bypass in sfturing hosp_order exposes its order cancellation endpoint to manipulation of the ID parameter, allowing an attacker to cancel medical orders belonging to any patient without owning those records (CWE-639 IDOR). The vulnerable function is orderRecordsService.cancelOrder in OrderController.java within this Java/SSM-stack hospital management application. A public exploit is documented in GitHub issue #116; the project maintainer has not responded to the disclosure, leaving no remediated version available.
Authorization bypass in sfturing hosp_order allows unauthenticated remote attackers to modify hospital order records belonging to arbitrary users by supplying attacker-controlled `userID` or `id` parameters to the `updateOrderSta1` and `updateOrderdiseaseInfo` endpoints in OrderController.java. A public proof-of-concept exploit was disclosed via GitHub issue #115; the maintainer has not responded to the report. The project follows a rolling release strategy, making version-pinned remediation guidance impossible - all commits through 627f426331da8086ce8fff2017d65b1ddef384f8 are confirmed affected.
Authorization bypass through user-controlled key (IDOR, CWE-639) in sfturing hosp_order's OrderController allows unauthenticated remote attackers to access or manipulate hospital order records belonging to arbitrary users by supplying a crafted `userIdenf` parameter. The affected codebase is a Java Spring-based hospital order management system, and the vulnerability is exposed via the `/ssm_pro` web application endpoint. A public proof-of-concept exists via GitHub issue #114; the maintainer has not responded to the disclosure, and no patch has been released.
Unverified password change in sfturing hosp_order allows unauthenticated remote attackers to arbitrarily modify any user's password through the `modifyPassWord` function in `CommonUserController.java`. The Password Recovery component fails to validate the requester's identity or current credentials before accepting a new password, enabling full account takeover without prior authentication. A public exploit has been released via the project's GitHub issue tracker, and the vendor has not responded to the disclosure.
Certificate revocation bypass in mwiede jsch through version 2.28.5 allows unauthenticated remote attackers to have a revoked SSH host certificate accepted as trusted during host verification. The `setKnownHosts()` parser in `KnownHosts.java` failed to recognize OpenSSH certificate key types (e.g., `ssh-ed25519-cert-v01@openssh.com`) as valid when paired with the `@revoked` marker, causing such entries to be skipped rather than tracked in the revocation pool - silently nullifying the revocation check. A public proof-of-concept is available via GitHub issue #1091, and the fix is released as version 2.28.6.
Improper access control in JeecgBoot's AI-RAG module (versions up to 3.9.3) permits a low-privileged authenticated user to invoke the exportXls endpoint in AiragModelController.java and extract LLM model credentials by manipulating the credential parameter beyond their authorization level. The attack is network-accessible and requires only a valid low-privileged session with no administrative rights. A public proof-of-concept is available via GitHub issue #9600, and a vendor patch has been released in version 3.9.5.
Unauthenticated access to the first-run Super-Admin bootstrap endpoint (/api/v1/bootstrap/setup) and all 17 admin/DPO console pages in tsi-coop tsi-dpdp-cms ≤0.5.0 allows remote attackers to claim full administrative control of any fresh or reset deployment and to retrieve page source containing internal API endpoints, function names, and request schemas. The root cause is CWE-306: console pages relied solely on client-side JavaScript redirects with no server-side session gate, and the bootstrap endpoint imposed no token or expiry requirement. A publicly available proof-of-concept exploit exists on GitHub; the vendor has released v0.5.1 which adds server-side session enforcement and a required deployment token.
Unauthenticated network attackers can elicit Java stack traces from Red Hat IdM's Dogtag CA REST enrollment endpoint (POST /ca/rest/certrequests) by submitting malformed requests, causing HTTP 500 responses that expose internal implementation details under CWE-209. The same error path simultaneously amplifies the CA debug log with large multi-line stack traces, creating a log-fill resource exhaustion vector that drives disk growth and I/O contention on affected RHEL 6 through 10 deployments. No public exploit has been identified at time of analysis, but the attack requires no authentication and low complexity, making it accessible to unskilled opportunistic attackers targeting IdM infrastructure.
Server-side request forgery in PowerJob up to version 5.1.2 allows unauthenticated remote attackers to issue arbitrary server-originated requests via the MuConnectionManager.getOrCreateConnection function exposed through the Transport Endpoint in TestController.java. Publicly available exploit code exists (confirmed by CVSS 4.0 E:P modifier and description), and no vendor patch is available - the project was notified via GitHub issue but has not responded. Successful exploitation can be used to probe internal services, access cloud instance metadata endpoints, or exfiltrate credentials from the server's internal network.
Unrestricted file upload in jeecgboot jeewx-boot's doUpload endpoint exposes the server to arbitrary file write via manipulation of the File argument in MyJwWebJwid3Controller, within the WeChat integration module. The vulnerability stems from improper access control (CWE-284) and public exploit code has been disclosed (CVSS 4.0 E:P), though the project maintainer has not yet responded to the issue report. The rolling-release development model means no fixed version can be cited, leaving all deployments at the affected commit hash and earlier without vendor guidance.
Authorization bypass in Soarkey StudentManagement (学生信息管理系统) exposes administrative functions to unauthenticated remote attackers by allowing manipulation of the `action` parameter in the Administrative Servlet's `AdminDao.doGet()` handler. The CVSS 4.0 vector confirms PR:N - no credentials required - and a public proof-of-concept exploit exists via GitHub issue #32. The project maintainer was notified but has not responded, leaving the vulnerability unpatched across all known versions through commit e08f7f1d.
Uncontrolled recursion in BBEdit's Java Language Module (versions through 15.5.5) allows a remote attacker to crash or hang the editor by delivering a specially crafted Java source file that a user then opens. The root cause is CWE-674: the Java parser lacks depth-limiting guards, enabling deeply nested constructs to exhaust the call stack and produce a denial-of-service against the editor process. No active exploitation has been recorded and no public proof-of-concept exploit code is known; the issue was surfaced through fuzzing research by Cipher Security Labs, and Bare Bones Software has released a fix in BBEdit 16.0.
Improper authorization in LogNet's grpc-spring-boot-starter affects annotation processing logic in versions up to 5.2.0, allowing authenticated remote attackers with low privileges to bypass access controls under high-complexity conditions. The vulnerability stems from CWE-266 (Incorrect Privilege Assignment) in the component responsible for processing security annotations on gRPC service endpoints. A proof-of-concept exploit has been publicly disclosed; no vendor patch is available as the project has not yet responded to the responsible disclosure report.
Memory corruption in LatencyUtils 2.0.3 and earlier allows a local low-privileged user to cause availability disruption by manipulating input to the `LatencyStats.recordDetectedPause` function in the PauseDetector component. A public proof-of-concept has been disclosed via a GitHub issue, and the project maintainers have not responded to the disclosure, leaving the library without an upstream fix. The CVSS 4.0 score of 1.9 and availability-only impact (VA:L) reflect a tightly scoped, low-severity flaw with no confidentiality or integrity consequences and no confirmed active exploitation.
Charset-confusion in MariaDB Connector/J (all branches prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows a server-side character set change mid-session to silently decouple the driver's UTF-8 encoding assumption from the server's active encoding. Because the driver continues escaping SQL string literals as UTF-8 while the server parses incoming bytes under a different multi-byte encoding (e.g., GBK or BIG5), the mismatch can defeat byte-wise SQL quoting and enable SQL injection - a well-documented attack class for charset-confusion primitives. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis.
MariaDB Connector/J exposes database account passwords in cleartext to on-path attackers or hostile servers when PAM (dialog) authentication is used over plain TCP. The driver's PAM handler (SendPamAuthPacketFactory, plugin name 'dialog') failed to override the requireSsl() gate that correctly protects its sibling mysql_clear_password plugin, inheriting a default value of false and thus omitting the secure-transport requirement. Under the default connector configuration (sslMode=DISABLE, restrictedAuth=null), a man-in-the-middle or rogue server can issue an Authentication Switch Request for the dialog plugin and receive the account password in cleartext, granting full credential reuse against the real database. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack mechanics are straightforward for any on-path attacker against affected deployments.
Cleartext database password disclosure in MariaDB Connector/J (all versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows an active network man-in-the-middle to capture a victim application's full database password during the initial TLS handshake. The connector's initial-handshake code path transmits a mysql_clear_password authentication response before validating the certificate fingerprint that is supposed to enforce server identity - a guard that the OK-packet and auth-switch paths correctly enforce but that HandshakeResponse.encode() bypasses entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the vulnerability mechanism is fully documented in a vendor-published HackerOne report and GHSA advisory.
Unauthorized token deletion in Graylog's REST API (versions 6.2.0 through 6.3.11, 7.0.0-7.0.6, and 7.1.0-7.1.1) allows any authenticated user to revoke access tokens belonging to other accounts - including administrators and service accounts - by exploiting a misplaced permission check in the token revocation endpoint. The flaw does not expose token secret values but can invalidate privileged credentials and disrupt automated integrations that rely on access tokens. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 6.3.12, 7.0.7, and 7.1.2.
Reflected XSS in Yamcs versions through 5.8.6 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a logged-in user's browser by delivering a specially crafted URL targeting the OAuth authorization endpoint. Exploitation exfiltrates the victim's session and refresh tokens to an attacker-controlled server, enabling complete account takeover. No public exploit identified at time of analysis independent of the advisory, though GHSA-rxpg-wjf8-qv9c includes a working reproduction payload with exact URL and netcat listener steps; vendor patch is available in 5.9.4 (CVSS 6.5, UI:R).
Missing authorization checks on three IAM REST API endpoints in Yamcs allow any authenticated low-privilege user to enumerate the server's complete privilege taxonomy and role-to-privilege mappings, directly enabling targeted privilege escalation reconnaissance. Affected are yamcs-core versions up to 5.12.7 and 5.13.0 through 5.13.1, used in production spacecraft operations and ground station environments. A proof-of-concept is confirmed in the GHSA advisory; no active exploitation (CISA KEV) has been identified, but the leaked data (including the ControlAccess and ChangeMissionDatabase privilege names) provides a precise roadmap for chained attacks including, per the advisory, algorithm-level remote code execution.
Unauthenticated access to Spring Boot Actuator management endpoints in Zipkin through 3.6.1 exposes sensitive operational data and configuration controls on the same port as the tracing API. Remote attackers with network reach to the Zipkin API port can read environment variables, bean configurations, and storage backend credentials via endpoints such as /actuator/env and /actuator/beans, or silently suppress security-relevant logging by modifying log levels via /actuator/loggers. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated remote exploitation; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unsafe header deserialization in Spring Integration's EmbeddedHeadersJsonMessageMapper exposes applications to header injection across all active release trains (5.5.x through 7.1.0). The decodeNativeFormat method constructs GenericMessage objects with MutableMessageHeaders populated directly from attacker-controlled JSON-deserialized header maps, bypassing sanitization by default in the constructor. Low-privileged network attackers who can submit crafted byte payloads to an affected consumer channel can manipulate message headers, yielding partial confidentiality, integrity, and availability impacts. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV.
Concurrent message processing in Spring Integration's script-backed channels causes shared ScriptEngine state corruption when using JSR-223 engines that declare THREADING=null, such as the Kotlin KTS engine. Affected Spring Integration versions from 5.5.21 and earlier through 7.1.0 are susceptible to cross-message data leakage, where one message's payload or header bindings can bleed into another message's script evaluation context under concurrent load. No public exploit has been identified at time of analysis, and the CVSS 4.2 Medium rating reflects the high attack complexity imposed by the required race condition, though the information disclosure and partial integrity impact are real concerns in multi-tenant or high-throughput deployments.
Link credit exhaustion in Spring AMQP 4.1.0 silently stalls AMQP listener containers when a container-level ErrorHandler is active. Each message delivery whose processing throws an exception permanently consumes one link credit without returning it to the broker; once the pool reaches zero (after the default 100 credits), the broker halts delivery while isRunning() continues to report true, masking the outage from standard health checks. No active exploitation has been confirmed (no CISA KEV listing, no public POC), but this is a realistic denial-of-service condition for any Spring-based messaging consumer running the affected version with an ErrorHandler configured.
RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.
Denial-of-service in Spring for Apache Kafka's `DeadLetterPublishingRecovererFactory` exposes consumer JVMs across all supported branches (2.8.x through 4.1.0) to crash or hang when processing messages with a crafted `retry_topic-original-timestamp` header. An authenticated Kafka producer can inject a ConsumerRecord carrying an oversized or malformed header byte array, which is passed without any length or format validation directly to Java's `BigInteger(byte[])` constructor, triggering heap memory exhaustion or an unhandled exception that disrupts message consumption. No public exploit code has been identified and the CVE does not appear in CISA KEV at time of analysis, but low attack complexity combined with broad version coverage makes this a credible availability threat for any Spring Kafka deployment using retry or dead-letter queue features.
Denial of Service in Spring Cloud Config's Monitor component allows unauthenticated remote attackers to crash or degrade the configuration server by submitting malicious payloads to the webhook endpoint. Affected versions span the 3.x, 4.x, and 5.x release lines, covering a broad installed base of Spring Boot microservice environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated network-accessible attack surface (PR:N, AV:N, AC:L) means exploitation requires minimal capability.
HTTP response splitting in Spring Framework affects applications that construct Content-Disposition HTTP headers by concatenating untrusted user-supplied file names without stripping CRLF characters, allowing remote attackers to inject arbitrary headers into HTTP responses. The vulnerability spans the entire actively-maintained Spring Framework lineage - versions 5.2.x through 7.0.8 - giving it a broad potential surface across Java enterprise application portfolios. No public exploit is identified at time of analysis, and EPSS at 0.16% (6th percentile) indicates low current exploitation probability.
Symlink redirection in Spring Integration's Zip/UnZip transformer allows a local unprivileged user sharing the same host to hijack transformer output by pre-creating /tmp/ziptransformer as a symlink before application startup. Affected versions span the 6.4, 6.5, 7.0, and 7.1 release lines, covering a wide range of enterprise Java deployments that use Spring Integration's file transformation capabilities. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the integrity and availability impact is rated High by the vendor-assigned CVSS score.
Spring Cloud Stream versions 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6 expose a deserialization of untrusted types flaw that could allow a network-positioned attacker with high privileges and required user interaction to gain limited read and write access to application data. The CVSS vector (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) reflects heavy exploitation constraints, making real-world abuse unlikely without insider-level access and specific preconditions. No public exploit code has been identified and the vulnerability is absent from CISA KEV at time of analysis.
Spring Cloud Stream's partition interceptor logic improperly inserts a partition interceptor during message sends under specific conditions, potentially routing messages to unintended partitions. Affected versions span three active release lines: 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6. An authenticated operator with high privileges who triggers a message send under the required conditions could cause limited information disclosure or message integrity degradation by routing data to an unintended partition consumer. No public exploit identified at time of analysis; CVSS score of 3.1 reflects the high access bar and narrow impact.
Improper content-type caching in the Avro component of Spring Cloud Stream can produce incorrect content-type metadata on processed messages, creating a low-severity information-disclosure and data-integrity risk. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release trains. Exploitation requires network access, high privilege level, high attack complexity, and user interaction, making real-world impact minimal; no public exploit code or active exploitation has been identified at time of analysis.
Spring Cloud Stream's dynamic destination cache lacks an upper bound on its size, exposing applications to limited information disclosure and integrity concerns under constrained conditions. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release lines, reported by VMware (Broadcom), the Spring project maintainer. No public exploit code exists and the vulnerability is not listed in CISA KEV; the low CVSS score of 3.1 reflects the highly constrained exploitation prerequisites including high privilege requirements and user interaction.
Sensitive data exposure in Spring Cloud Stream versions 4.2.0-4.2.6, 4.3.0-4.3.3, and 5.0.0-5.0.2 allows logging of sensitive information - such as message payloads, headers, or configuration values - under specific conditions. The vulnerability is classified as information disclosure with a low CVSS base score of 3.1, reflecting the high attack complexity and privilege requirements. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Spring Cloud Function's Azure integration may inadvertently log sensitive data across three affected release lines (4.2.0-4.2.7, 4.3.0-4.3.4, 5.0.0-5.0.3), resulting in low-impact information disclosure. The vulnerability is constrained by a high-privilege, high-complexity, user-interaction-required exploitation profile (CVSS 3.1), making it a low-priority issue for most organizations. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog; the primary risk is credential or token leakage through application log aggregators accessible to operators or compromised log pipelines.
Spring Cloud Function's AWS adapter component may inadvertently write sensitive data to application logs, creating an information disclosure exposure across a wide range of maintained version branches (3.x through 5.x). The CVSS score of 3.1 reflects genuinely low severity - exploitation requires high privileges and high attack complexity - but the risk in regulated or multi-tenant environments is elevated if log stores are accessible to unauthorized parties or if sensitive data (credentials, payloads, tokens) persists in cloud-native logging services such as AWS CloudWatch. No public exploit code exists and no active exploitation has been identified at time of analysis.
Spring Cloud Function's composition lookup mechanism can be abused by a highly privileged attacker to poison the base function, potentially degrading the integrity and confidentiality of function execution across versions 3.2.16 and earlier through 5.0.3. The vendor-assigned CVSS base score of 3.1 reflects severely constrained exploitation prerequisites - high privilege level, high attack complexity, and required user interaction - substantially limiting realistic exposure. No public exploit code has been identified, and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
HTTP header filtering deficiency in Spring Cloud Function versions 5.0.0-5.0.3, 4.3.0-4.3.4, 4.2.0-4.2.7, and 3.2.16 and earlier allows network-accessible authenticated attackers - under high-complexity conditions and requiring user interaction - to achieve limited confidentiality and integrity impacts via crafted HTTP headers. Reported by VMware, the flaw scores 3.1 (Low) under CVSS 3.1, with multiple compounding prerequisites that substantially restrict real-world exploitability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Spring Cloud Function's ServerlessHttpServletRequest.isSecure() method returns an unchecked result that does not reflect the actual HTTP transport scheme, enabling applications that gate security decisions on this call to behave incorrectly. Affected versions span three active release lines: 5.0.0-5.0.3, 4.3.0-4.3.4, and 4.2.0-4.2.7. No public exploit code exists and the vulnerability is not listed in CISA KEV; the vendor-assigned CVSS of 3.1 (Low) reflects constrained exploitation prerequisites including high privilege and user interaction.
Path traversal in Spring AI's ResourceCacheService allows an authenticated low-privileged network attacker to write files outside the intended cache directory. The getCacheName() method appends URI fragments verbatim - including '../' sequences and path separators - to a base directory path before passing the result to new File(resourceParentFolder, newFileName) and writing downloaded bytes there. Affected versions span Spring AI 1.0.9 and earlier, 1.1.0 through 1.1.8, and 2.0.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Spring Integration's jCIFS-based SMB client silently negotiates down to legacy SMB1/CIFS when applications omit an explicit `smbMinVersion` setting, exposing file transfer sessions to NTLM relay attacks and in-transit content tampering by a network-positioned adversary. Affected versions span Spring Integration 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, and the standalone release 7.1.0 - covering all currently active Spring Integration release trains at time of disclosure. No CISA KEV listing or public exploit code specific to this CVE has been identified at time of analysis, though NTLM relay is a mature, extensively tooled attack class; EPSS data was not available in the sourced intelligence.
Spring Integration's default file-based metadata store writes persistent state to a world-readable file under java.io.tmpdir, exposing integration metadata to any local OS user on the affected host. All actively maintained branches are affected, spanning versions 5.5.21 and earlier through 7.1.0. No public exploit code or active exploitation has been identified at time of analysis; practical impact is limited to local confidentiality disclosure on shared or multi-user systems.
Spring Cloud Function versions across three actively maintained release lines (4.2.x, 4.3.x, and 5.0.x) are affected by a potential arbitrary file read and SSRF vulnerability reported by VMware. The vendor-assigned CVSS 3.1 score of 2.0 reflects severe constraints on exploitability - high privilege requirements (PR:H), required user interaction (UI:R), and high attack complexity (AC:H) together make opportunistic or unauthenticated exploitation implausible. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
Resource exhaustion in Spring for GraphQL's WebSocket client allows unauthenticated remote attackers to trigger a Denial of Service when the keepAlive feature is enabled. Three release trains are affected: 1.3.x through 1.3.9, 1.4.x through 1.4.6, and 2.0.x through 2.0.4, as confirmed by the VMware/Spring vendor advisory. No public exploit code has been identified and EPSS at 0.15% (4th percentile) indicates low near-term exploitation probability, though the lack of authentication requirement warrants patching for any deployment exposing WebSocket endpoints to untrusted networks.
Reflected XSS in Spring Framework's MVC and WebFlux data-binding error rendering exposes users of vulnerable applications to arbitrary HTML and JavaScript injection. All active Spring Framework release trains are affected - versions 5.2.x through 7.0.8 - making the exposure surface extremely broad across enterprise Java deployments. An unauthenticated attacker (per CVSS PR:N) can craft a malicious URL containing injected script payloads that, when a victim clicks it, execute in the victim's browser context via reflected field-error output. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating limited observed exploitation activity at time of analysis.
Spring Security 7.1.0's InetAddressMatchers utility contains a flaw in its IP address classification logic - the matchInternal() and matchExternal() builders may incorrectly categorize certain IP addresses as belonging to internal or external networks, enabling unauthenticated remote attackers to bypass IP-based access controls under high-complexity conditions. Applications that rely on InetAddressMatchers to enforce network-level access restrictions are exposed to limited information disclosure where restricted endpoints or data may become accessible to external parties. No public exploit code exists and no CISA KEV listing is present, indicating no confirmed active exploitation at time of analysis.
Timing side-channel exposure in Spring Security allows remote unauthenticated attackers to progressively infer security-sensitive string values - such as CSRF tokens, bearer tokens, or other secrets compared at the application layer - by statistically measuring the time differential between rejection responses. Multiple active Spring Security release trains are affected, spanning versions 5.7.x through 7.1.x, representing a broad swath of production Spring-based Java applications. No public exploit code has been identified at time of analysis, and CISA KEV status is absent; however, the confidentiality impact is rated High in the CVSS vector, reflecting that successful exploitation could fully compromise protected secrets under favorable network conditions.
Incomplete NAT64 prefix filtering in CC: Tweaked prior to 1.120.0 allows any Lua-capable Minecraft player on a dual-stack server to bypass SSRF protections and reach loopback, RFC 1918, cloud metadata, or internal API endpoints. The flaw resides in AddressPredicate.java, which correctly blocks the RFC 6052 Well-Known NAT64 prefix (64:ff9b::/96) but omits the RFC 8215 Local-Use prefix (64:ff9b:1::/48), enabling requests via http.request or http.websocket to mapped internal IPv4 addresses. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation requires a non-default dual-stack NAT64 deployment.
Path traversal in Spring Framework's FreeMarker integration allows authenticated remote attackers to read arbitrary files from the server's template path when a controller passes user-controlled input directly as a view name. Affected versions span every maintained Spring Framework branch from 5.2.x through 7.0.8, making the exposure broad in the Java ecosystem. No public exploit code or active exploitation has been identified; CISA's SSVC assessment rates technical impact as partial and the vulnerability as non-automatable, consistent with the configuration dependency required to trigger it.
TLS certificate validation is absent by default in Spring AMQP's Log4j2 appender when shipping log events to a RabbitMQ broker, leaving all log traffic fully exposed to man-in-the-middle interception. Spring AMQP versions 2.4.18 and earlier, 3.2.0-3.2.12, 4.0.0-4.0.4, and 4.1.0 are affected when the Log4j2 appender is used with its documented default configuration. No public exploit has been identified at time of analysis, but the high confidentiality and integrity CVSS impact reflects that intercepted log streams may contain API keys, session tokens, and other sensitive application data.
Open redirect in Spring Authorization Server 1.5.0-1.5.7 allows remote unauthenticated attackers to redirect victims to attacker-controlled sites by crafting authorization requests that pair an invalid request_uri with an unvalidated redirect_uri. The CVSS scope change (S:C) reflects that the redirect escapes the authorization server's security boundary, enabling high-trust phishing attacks because victims see the legitimate authorization server domain before being redirected. No public exploit has been identified at time of analysis, and exploitation requires user interaction.
Header type injection in Spring for Apache Kafka's default mapper configuration allows any Kafka producer with access to a consumed topic to inject java.net.InetAddress objects through the spring_json_header_types message header, triggering DNS resolution on the consumer host. All applications using @KafkaListener with the default JsonKafkaHeaderMapper or DefaultKafkaHeaderMapper - spanning versions 2.8.x through 4.1.0 - are affected without any non-default configuration required. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Denial-of-service in Spring AMQP across multiple supported release lines allows a privileged AMQP publisher to force a System.exit(99) call inside the consumer JVM, killing the entire process rather than isolating the failure to the listener thread. Affected versions span the 2.4.x, 3.2.x, 4.0.x, and 4.1.0 release trains, covering a wide swath of actively maintained Spring deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total, immediate JVM termination and the collateral impact on every co-located workload make this operationally significant in RabbitMQ-integrated Spring environments.
Spring Integration's UnZipTransformer component fails to impose any limit on decompressed entry size or entry count, enabling a low-privileged remote attacker to trigger JVM heap exhaustion via a crafted zip bomb archive. Affected versions span 6.4.0-6.4.12, 6.5.0-6.5.10, and 7.0.0-7.1.0 across the widely-used Spring enterprise Java framework. The attack primitive is well-understood and trivially constructable, though exploitation requires access to an integration endpoint that routes payloads through UnZipTransformer; no public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Cleartext credential exposure in Spring AMQP affects applications that use the RabbitMQ management aliveness check: when that check fails at runtime, the configured admin password is embedded verbatim in the thrown Java exception message, making it visible to anyone with access to exception output. The vulnerability spans multiple major release lines - 2.4.x, 3.2.x, and 4.0.x through 4.1.0 - and was reported by security@vmware.com, the Spring Security team. No public exploit code has been identified at time of analysis and CISA KEV status is unconfirmed, but a successful credential leak would yield full RabbitMQ administrative control.
Open redirect in Spring Framework's UrlFileNameViewController exposes users of affected Spring MVC applications to phishing and credential-harvesting attacks across all active Spring Framework release trains (5.2.x through 7.0.x). The flaw allows an unauthenticated attacker to craft a URL that causes the vulnerable application to redirect victims to an arbitrary external domain, exploiting the controller's path-to-view-name resolution when end-of-path mapping is used without a configured prefix. No active exploitation has been confirmed - EPSS sits at 0.14% (4th percentile) and CISA SSVC reports exploitation status as none, making this a targeted patching priority rather than an emergency.
Open redirect in Spring Framework's UrlHandlerFilter allows unauthenticated remote attackers to silently redirect authenticated users to attacker-controlled URLs. Affected are Spring Framework 7.0.0-7.0.8 and 6.2.0-6.2.19 in both Spring MVC and Spring WebFlux deployments where UrlHandlerFilter is configured with broadly matching URL patterns. No public exploit code exists and SSVC indicates no known active exploitation; however, the no-privilege, network-reachable attack vector makes this a credible phishing enabler in affected applications. EPSS sits at 0.15% (5th percentile), consistent with low-automated-exploitation likelihood.
Spring Integration JMS inbound components copy inbound JMS message properties verbatim into Spring MessageHeaders without filtering reserved internal header names, enabling any authorized JMS producer to inject routing and type-resolution headers. All supported release lines are affected - from 5.5.21 and earlier through the current 7.1.0 - making this a broad exposure across enterprise Java integration deployments. No public exploit has been identified at time of analysis; however, injection of the json__TypeId__ header may interact with Jackson polymorphic deserialization if enabled, potentially elevating practical impact beyond the assigned CVSS 5.4 Medium.
Reflected cross-site scripting (XSS) in Spring Security's built-in OAuth2 Authorization Server consent page allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted authorization request URL. Affected versions include Spring Security 7.1.0 and 7.0.0 through 7.0.6; the consent page reflects user-controlled values (such as client name or scope parameters) directly into the HTML response without encoding. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog, but the changed-scope CVSS vector reflects the elevated risk of token and session theft in OAuth2 flows.
Spring Integration's UDP inbound adapter can be abused by unauthenticated remote attackers to coerce the server into emitting outbound UDP datagrams to arbitrary hosts and ports - a classic UDP Server-Side Request Forgery (SSRF). Affected versions span the entire supported line from 5.5.x through 7.1.0, covering a wide range of enterprise Java deployments. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity (single crafted UDP packet) makes this straightforward to weaponize once the adapter port is located.
Path traversal in Spring Integration's ZipTransformer allows a low-privileged attacker who controls the file_name message header to write ZIP archive output to arbitrary filesystem paths outside the configured workDirectory. Affected versions span the 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines of Spring Integration, and exploitation is viable by default since ZipResultType.FILE is the standard configuration. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Spring AMQP's optional message decompression feature allows any principal with queue publish access to crash the consumer JVM by sending a single crafted ~1 MB compressed message. Affected versions span the 2.4.x, 3.2.x, 4.0.x, and 4.1.0 release lines, making this a broad supply-chain concern for Spring-based Java messaging infrastructure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and high availability impact warrant prompt remediation in any environment where queue publish access is shared or externally reachable.
Uncontrolled memory allocation in Spring Integration's RFC6587SyslogDeserializer allows any network-reachable, low-privileged syslog sender to supply an arbitrarily large octet count, causing the TCP inbound adapter to allocate an unbounded byte array and potentially read across RFC 6587 message frame boundaries. Affected release lines span 5.5.x through 7.1.0. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the low attack complexity and low privilege requirement make exploitation straightforward for any entity permitted to deliver syslog messages to the adapter.
Unsafe deserialization in Spring Integration exposes network-accessible, low-privilege attackers to arbitrary Java class instantiation by manipulating the json__TypeId__ message header, which is resolved via ClassUtils.forName without any type or package allowlist. All maintained Spring Integration branches are affected - 5.5.21 and earlier, 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, and 7.1.0 - making the exposure broad across the Spring ecosystem. No public exploit code or CISA KEV listing has been identified at time of analysis, though the deserialization-via-header-controlled-type pattern is a well-understood Java attack class with a mature exploit toolkit.
Spring Data REST's HTTP PUT handler silently drops the persisted `@Version` field when writing immutable aggregate root types, bypassing the framework's optimistic locking mechanism. Affected release trains span versions 3.x through 5.1.0, covering a broad surface of Spring-based enterprise REST APIs that use versioned immutable entities. An authenticated low-privilege attacker can exploit this to perform lost-update attacks - overwriting entity state without triggering concurrency conflict detection - undermining data integrity guarantees in concurrent-write environments. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Denial-of-service and minor integrity impact in Oracle Java SE 7u511 allows unauthenticated remote attackers to crash or hang the JVM via the 2D graphics rendering component, exploitable across multiple network protocols with no authentication or user interaction required. The attack surface is broadened by the component's exposure through APIs consumed by web services, sandboxed Java Web Start applications, and sandboxed Java applets loading untrusted code. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the low exploitation complexity means automated scanning is feasible.
AES/CBC encryption in Spring Security's AesBytesEncryptor silently degrades to a null (all-zero) initialization vector when applications use the two-argument constructor or pass a null IV generator with CBC mode selected, completely undermining the semantic security of any data encrypted through this code path. Affected versions span Spring Security 5.7.0 through 7.1.0, covering multiple active release lines used extensively in Java and Spring Boot enterprise applications. No public exploit code has been identified at time of analysis, but the CVSS confidentiality impact is rated High and exploitation requires only low-privilege access to any application instantiating the vulnerable encryptor pattern.