Known Vulnerabilities for Spring Boot by Spring
Listed below are 10 of the newest known vulnerabilities associated with "Spring Boot" by "Spring".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-45091 json | sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise ... | Not Provided | 2026-05-12 | 2026-05-12 |
| CVE-2026-40977 json | When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's loc... | Not Provided | 2026-04-28 | 2026-04-28 |
| CVE-2026-40976 json | In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. Fo... | Not Provided | 2026-04-28 | 2026-04-29 |
| CVE-2026-40975 json | Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${r... | Not Provided | 2026-04-28 | 2026-04-28 |
| CVE-2026-40974 json | Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cass... | Not Provided | 2026-04-28 | 2026-04-28 |
| CVE-2026-40973 json | A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. ... | Not Provided | 2026-04-28 | 2026-04-29 |
| CVE-2026-40972 json | An attacker on the same network as the remote application may be able to utilize a timing attack to discover information abou... | Not Provided | 2026-04-28 | 2026-04-29 |
| CVE-2026-40971 json | When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when c... | Not Provided | 2026-04-27 | 2026-04-28 |
| CVE-2026-40970 json | When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification w... | Not Provided | 2026-04-27 | 2026-04-27 |
| CVE-2026-22733 json | Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endp... | Not Provided | 2026-03-20 | 2026-03-20 |