Veille CVE

Mercredi 2 septembre 2026

4 CVE

Critique 0 Élevée 1 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Spring Security » ✕
  1. CVE-2026-59277 5.3 Moyenne

    Spring Security · Vmware spring security

    Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7.1.0

  2. CVE-2026-59276 5.9 Moyenne

    Spring Security · Vmware spring security

    Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

  3. CVE-2026-47877 6.1 Moyenne

    Spring Security · Vmware spring security

    Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6

  4. CVE-2026-59324 8.2 Élevée

    Spring Integration · Vmware spring integration

    When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier