Spring Cloud Gateway

Spring Patches Two Flaws: SpEL Injection (CVE-2025-41253) Leaks Secrets, STOMP CSRF Bypasses WebSocket Security Spring Data vulnerabilities Spring Cloud Config CVE-2026-22739 Spring Gateway SpEL, STOMP WebSocket CSRF Spring Security, vulnerability CVE-2024-38819 CVE-2025-41243 Spring Cloud Gateway, vulnerability

Spring Data vulnerabilities Spring Cloud Config CVE-2026-22739 Spring Gateway SpEL, STOMP WebSocket CSRF Spring Security, vulnerability CVE-2024-38819 CVE-2025-41243 Spring Cloud Gateway, vulnerability

Spring Patches Two Flaws: SpEL Injection (CVE-2025-41253) Leaks Secrets, STOMP CSRF Bypasses WebSocket Security

Do Son October 17, 2025

VMware Tanzu’s Spring team has released fixes for two vulnerabilities impacting Spring Cloud Gateway and the Spring...

PoC Released for CVE-2025-41243 – A Spring Cloud Gateway Flaw with CVSS 10.0

PoC Released for CVE-2025-41243 – A Spring Cloud Gateway Flaw with CVSS 10.0

Do Son September 22, 2025

Security researcher Ezzer17 published a clear, methodical write-up that walks through the root cause, the partial fixes,...

CVE-2025-41243 (CVSS 10): Critical Spring Cloud Gateway Server WebFlux Flaw Exposes Property Modification Risk Spring Data vulnerabilities Spring Cloud Config CVE-2026-22739 Spring Gateway SpEL, STOMP WebSocket CSRF Spring Security, vulnerability CVE-2024-38819 CVE-2025-41243 Spring Cloud Gateway, vulnerability

Spring Data vulnerabilities Spring Cloud Config CVE-2026-22739 Spring Gateway SpEL, STOMP WebSocket CSRF Spring Security, vulnerability CVE-2024-38819 CVE-2025-41243 Spring Cloud Gateway, vulnerability

CVE-2025-41243 (CVSS 10): Critical Spring Cloud Gateway Server WebFlux Flaw Exposes Property Modification Risk

Do Son September 9, 2025

Spring has disclosed a critical vulnerability in Spring Cloud Gateway Server WebFlux that allows attackers to modify...

Spring Cloud Gateway Vulnerability Exposes Applications to Header Injection Risks

Spring Cloud Gateway vulnerability Header spoofing

Spring Cloud Gateway Vulnerability Exposes Applications to Header Injection Risks

Do Son May 30, 2025

A newly disclosed vulnerability in Spring Cloud Gateway Server could expose applications to header spoofing and potential...

🚨

Receive alerts for vulnerabilities being exploited in the wild.

⚡

Get notified instantly when a Proof of Concept (PoC) exploit is published.

🔍

Access critical info on vulnerabilities even when marked as "RESERVED".

🧠

Insights powered by decades of expertise and global intelligence sources.

🎯

Customize alerts with up to 10 keywords for your specific tech stack.

📊

Export the raw CVE database for SIEM integration and reporting.

CVE-2026-59309CVSS 9.8
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to...
Admin intel📅 Updated: Aug 15, 2026
CVE-2026-65400CVSS 9.8
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS...
Admin intel📅 Updated: Aug 15, 2026
CVE-2026-15826CVSS 9.8
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up...
Admin intel📅 Updated: Aug 15, 2026
CVE-2026-72898CVSS 10.0
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator...
CISA KEV📅 Added to KEV: Aug 11, 2026
CVE-2026-20349CVSS 8.6
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software...
CISA KEV📅 Added to KEV: Aug 11, 2026
CVE-2026-68820CVSS 7.0
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CISA KEV📅 Added to KEV: Aug 11, 2026
CVE-2026-63077CVSS 9.8
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CISA KEV📅 Added to KEV: Aug 5, 2026
CVE-2026-34486CVSS 7.5
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of...
CISA KEV📅 Added to KEV: Aug 4, 2026