Spring

Spring Data REST and Spring AI Vulnerabilities: Four High-Severity Flaws Patched Spring vulnerabilities advisory covering Spring Data REST and Spring AI four high severity flaws CVE-2026-47849

Spring Data REST and Spring AI Vulnerabilities: Four High-Severity Flaws Patched

Do Son August 21, 2026

TL;DR VMware disclosed four Spring vulnerabilities on August 20, 2026. All rate as HIGH severity. One hits...

CVE-2025-41243 (CVSS 10): Critical Spring Cloud Gateway Server WebFlux Flaw Exposes Property Modification Risk Spring Data vulnerabilities Spring Cloud Config CVE-2026-22739 Spring Gateway SpEL, STOMP WebSocket CSRF Spring Security, vulnerability CVE-2024-38819 CVE-2025-41243 Spring Cloud Gateway, vulnerability

Spring Data vulnerabilities Spring Cloud Config CVE-2026-22739 Spring Gateway SpEL, STOMP WebSocket CSRF Spring Security, vulnerability CVE-2024-38819 CVE-2025-41243 Spring Cloud Gateway, vulnerability

CVE-2025-41243 (CVSS 10): Critical Spring Cloud Gateway Server WebFlux Flaw Exposes Property Modification Risk

Do Son September 9, 2025

Spring has disclosed a critical vulnerability in Spring Cloud Gateway Server WebFlux that allows attackers to modify...

🚨

Receive alerts for vulnerabilities being exploited in the wild.

⚡

Get notified instantly when a Proof of Concept (PoC) exploit is published.

🔍

Access critical info on vulnerabilities even when marked as "RESERVED".

🧠

Insights powered by decades of expertise and global intelligence sources.

🎯

Customize alerts with up to 10 keywords for your specific tech stack.

📊

Export the raw CVE database for SIEM integration and reporting.

CVE-2026-14894CVSS 9.8
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload...
Admin intel📅 Updated: Sep 4, 2026
CVE-2026-85046CVSS 8.8
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code...
Admin intel📅 Updated: Sep 3, 2026
CVE-2026-32475CVSS 9.0
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue...
Admin intel📅 Updated: Sep 2, 2026
CVE-2026-48710CVSS 6.5
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated...
CISA KEV📅 Added to KEV: Sep 2, 2026
CVE-2026-49869CVSS 10.0
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs")...
CISA KEV📅 Added to KEV: Sep 2, 2026
CVE-2026-59822
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to...
CISA KEV📅 Added to KEV: Sep 2, 2026
CVE-2026-83549CVSS 7.8
Post-authentication Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') vulnerability has been identified...
Admin intelCISA KEV📅 Added to KEV: Sep 2, 2026📅 Updated: Sep 1, 2026
CVE-2026-83548CVSS 10.0
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access...
Admin intelCISA KEV📅 Added to KEV: Sep 2, 2026📅 Updated: Sep 1, 2026