WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Oracle product: Oracle Fusion Middleware / Third Party (Spring Framework)✕
Overview 17 matches · 16 in Waratek scope · 6 protected · 2 exploited · 1 CISA KEV · 4 public PoC · 2 EPSS ≥ 0.5
17matches 16in Waratek scope94.1% 6protected35.3% 2exploited11.8% 1CISA KEV5.9% 4public PoC23.5% 2EPSS ≥ 0.511.8%
Protected by Waratek 6 35.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 10 58.8% Outside Waratek scope 0 0.0% Not applicable 1 5.9% Withdrawn CVE 0 0.0%
Critical 1 5.9% High 7 41.2% Medium 8 47.1% Low 1 5.9% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 6 35.3% partly blocked 0 0.0% not blocked 11 64.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 11.8% Working exploit published 1 5.9% Proof of concept only 1 5.9% Forecast only 0 0.0% No public exploit 13 76.5%
split by peak 4 / quarter
Not applicable: 1No exploit published: 10Protected by Waratek: 6 Low: 1Medium: 8High: 7Critical: 1 not blocked: 11blocked by ARMR today: 6 No public exploit: 13Proof of concept only: 1Working exploit published: 1Exploited: 2
Q3 201 No exploit published1 Medium1 not blocked1 No public exploit1 Q4 200 Q1 210 Q2 210 Q3 210 Q4 210 Q1 220 Q2 224 Protected by Waratek2 No exploit published2 Critical1 Medium3 blocked by ARMR today2 not blocked2 Exploited1 No public exploit3 Q3 220 Q4 220 Q1 232 No exploit published2 High1 Medium1 not blocked2 No public exploit2 Q2 230 Q3 230 Q4 230 Q1 242 Protected by Waratek1 Not applicable1 High2 blocked by ARMR today1 not blocked1 Proof of concept only1 No public exploit1 Q2 241 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q3 241 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Q4 243 Protected by Waratek1 No exploit published2 High1 Medium2 blocked by ARMR today1 not blocked2 Working exploit published1 No public exploit2 Q1 250 Q2 250 Q3 251 No exploit published1 High1 not blocked1 No public exploit1 Q4 250 Q1 262 No exploit published2 Medium1 Low1 not blocked2 No public exploit2
Q3 20Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23Q1 24Q3 24Q1 25Q3 25Q1 26
17 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-22737 Medium 2026-03-20 No exploit published No public exploit Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
CVE-2026-22735 Low 2026-03-20 No exploit published No public exploit Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
CVE-2025-41249 High 2025-09-16 No exploit published No public exploit The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions. Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction with CVE-2025-41248 https://spring.io/security/cve-2025-41248 .
CVE-2024-38819 High 2024-12-19 Protected by Waratek Working exploit published Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
CVE-2024-38828 Medium 2024-11-18 No exploit published No public exploit Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.
CVE-2024-38820 Medium 2024-10-18 No exploit published No public exploit The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
CVE-2024-38816 High 2024-09-13 Protected by Waratek Exploited Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. Specifically, an application is vulnerable when both of the following are true: * the web application uses RouterFunctions to serve static resources * resource handling is explicitly configured with a FileSystemResource location However, malicious requests are blocked and rejected when any of the following is true: * the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use * the application runs on Tomcat or Jetty
CVE-2024-22262 High 2024-04-16 Protected by Waratek No public exploit Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259  and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
CVE-2024-22259 High 2024-03-16 Protected by Waratek No public exploit Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
CVE-2024-22243 High 2024-02-23 Not applicable Proof of concept only Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.
CVE-2023-20860 High 2023-03-27 No exploit published No public exploit Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
CVE-2023-20861 Medium 2023-03-23 No exploit published No public exploit In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
CVE-2022-22970 Medium 2022-05-12 No exploit published No public exploit In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CVE-2022-22968 Medium 2022-04-14 No exploit published No public exploit In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
CVE-2022-22965 Critical 2022-04-01 Protected by Waratek Exploited A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22950 Medium 2022-04-01 Protected by Waratek No public exploit n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CVE-2020-5421 Medium 2020-09-19 No exploit published No public exploit In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.