KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted…
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allows Reflected XSS. Doggo.normalize_value/2 in lib/doggo.ex returned date field values wrapped in {:safe, ...}, the Phoenix.HTML marker…
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero…
A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine), concurrent message processing can corrupt engine-internal state, potentially…
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with…
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 -…
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 -…
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier
Brak walidacji długości nagłówka w Spring for Apache Kafka może prowadzić do przepełnienia bufora.
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An…
Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier
Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier
Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier
Potencjalne logowanie wrażliwych danych w Spring Cloud Function może prowadzić do ujawnienia informacji.
Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
Nieprawidłowe ograniczenie rozmiaru dynamicznej pamięci podręcznej w Spring Cloud Stream może prowadzić do przepełnienia pamięci.
Nieprawidłowe buforowanie typu oryginalnej treści w Spring Cloud Stream może prowadzić do ujawnienia danych.
Nieprawidłowe dodanie interceptora partycji w Spring Cloud Stream może prowadzić do nieprzewidzianego zachowania.
Deserializacja niezaufanych typów w Spring Cloud Stream może prowadzić do wykonania złośliwego kodu.
Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 -…
Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0…
ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded…
Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-81524 A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target… |
Pozostałe |
CVSS 5,3EPSS 0,27 % | ||
| CVE-2026-65931 LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global… |
Pozostałe |
CVSS 5,1EPSS 0,4 % | ||
| CVE-2026-66353 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allows Reflected XSS. Doggo.normalize_value/2 in lib/doggo.ex returned… |
Pozostałe |
CVSS 5,3EPSS 0,54 % | ||
| CVE-2026-59320 When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After… |
Pozostałe |
CVSS 6,5EPSS 0,42 % | ||
| CVE-2026-59321 A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine),… |
Pozostałe |
CVSS 5,4EPSS 0,18 % | ||
| CVE-2026-59322 The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes… |
Pozostałe |
CVSS 6,3EPSS 0,29 % | ||
| CVE-2026-59311 A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the… |
Pozostałe |
CVSS 6,8EPSS 0,39 % | ||
| CVE-2026-59314 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0… |
Pozostałe |
CVSS 3,7EPSS 0,26 % | ||
| CVE-2026-59315 The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config… |
Pozostałe |
CVSS 5,3EPSS 0,4 % | ||
| CVE-2026-59317 Brak walidacji długości nagłówka w Spring for Apache Kafka może prowadzić do przepełnienia bufora. |
Pozostałe |
CVSS 6,5EPSS 0,42 % | ||
| CVE-2026-59319 RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and… |
Pozostałe |
CVSS 4,3EPSS 0,3 % | ||
| CVE-2026-59298 Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 -… |
Pozostałe |
CVSS 3,5EPSS 0,22 % | ||
| CVE-2026-59299 Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 -… |
Pozostałe |
CVSS 3,5EPSS 0,21 % | ||
| CVE-2026-59300 Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud… |
Pozostałe |
CVSS 3,5EPSS 0,21 % | ||
| CVE-2026-59301 Potencjalne logowanie wrażliwych danych w Spring Cloud Function może prowadzić do ujawnienia informacji. |
Pozostałe |
CVSS 4,9EPSS 0,23 % | ||
| CVE-2026-59302 Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6 |
Pozostałe |
CVSS 4,9EPSS 0,17 % | ||
| CVE-2026-59303 Nieprawidłowe ograniczenie rozmiaru dynamicznej pamięci podręcznej w Spring Cloud Stream może prowadzić do przepełnienia pamięci. |
Pozostałe |
CVSS 3,8EPSS 0,21 % | ||
| CVE-2026-59304 Nieprawidłowe buforowanie typu oryginalnej treści w Spring Cloud Stream może prowadzić do ujawnienia danych. |
Pozostałe |
CVSS 3,8EPSS 0,21 % | ||
| CVE-2026-59305 Nieprawidłowe dodanie interceptora partycji w Spring Cloud Stream może prowadzić do nieprzewidzianego zachowania. |
Pozostałe |
CVSS 3,8EPSS 0,21 % | ||
| CVE-2026-59306 Deserializacja niezaufanych typów w Spring Cloud Stream może prowadzić do wykonania złośliwego kodu. |
Pozostałe |
CVSS 3,8EPSS 0,23 % | ||
| CVE-2026-59291 Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 |
Pozostałe |
CVSS 5,5EPSS 0,25 % | ||
| CVE-2026-59292 PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable… |
Pozostałe |
CVSS 3,2EPSS 0,15 % | ||
| CVE-2026-59293 Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and… |
Pozostałe |
CVSS 6,6EPSS 0,24 % | ||
| CVE-2026-59294 ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new… |
Pozostałe |
CVSS 6,5EPSS 0,36 % | ||
| CVE-2026-59297 Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud… |
Pozostałe |
CVSS 3,5EPSS 0,13 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 03:02 UTC – 13.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.