CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Affects Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Affects Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, and 5.3.0-5.3.49.
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Affects Spring Integration versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.
In Spring Integration, an operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Affected versions include 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.
Vulnerability in Spring Cloud Stream allows deserialization of untrusted types, which may lead to remote code execution or other deserialization attacks.
In Spring Cloud Stream, the partition interceptor may be improperly added while sending a message, which could lead to unexpected behavior in message processing.
In Spring Cloud Stream Avro, improper caching of the original content type may lead to incorrect processing of Avro data.
In Spring Cloud Stream, the dynamic destination cache size is not properly bound, which may lead to uncontrolled memory growth or other resource issues.
In Spring Cloud Stream, there is a potential for logging sensitive data, which may lead to leakage of confidential information into logs.
In Spring Cloud Function Azure, there is a potential for logging sensitive data, which may lead to leakage of confidential information into logs.
In Spring Cloud Function AWS, there is a potential for logging sensitive data, which may lead to leakage of confidential information into logs.
In Spring Cloud Function, composition lookup can potentially poison the base function, which may lead to unauthorized code execution or manipulation of function behavior.
In Spring Cloud Function, there is a potential for improper filtering of HTTP headers, which may lead to header injection or other header-related attacks.
The implementation of isSecure() in ServerlessHttpServletRequest does not verify the actual scheme, which may lead to incorrect determination of connection security.
ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Affects Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.9 and earlier.
Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Affects Spring Integration versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Affects Spring Integration versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 and earlier.
Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Affects versions 5.0.0-5.0.3, 4.3.0-4.3.4, and 4.2.0-4.2.7.
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9.
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, 1.1.0-1.3.9, and 1.0.0-1.0.7.