Vendor security profile

Spring

Product portfolio, patch evidence and exploitation signals in a single security scorecard

The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.Scope: all CVE records matched to the company · Source evidence is on each CVE's page

Total CVEs95

Critical7

CISA KEV0

Public exploit0

Patch rate%16

Avg. CVSS6.2

12-month vulnerability rate

CVEs published, and the CISA KEV records among them

Kas

Ara

Oca

Şub

Mar

Nis

May

Haz

Tem

Ağu

Eyl

Eki

CVE KEV

CVE severity distribution

The company's whole portfolio of recorded CVEs

95toplam CVE

Critical7 (7%)

High26 (27%)

Medium47 (49%)

Low15 (16%)

Patch and exploitation view

Patch evidence, public exploits and active exploitation signals together

%16

Verified patch

15 records

CISA KEV

0 records

Public exploit

0 records

15Patch available

0Partial

0Workaround

0Vendor: no patch

80Unknown

Latest vulnerabilities

The 10 newest records · metrics are calculated over the whole period

View all

8.6

CVE-2026-56100

SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint

VendorSpringBladeProductSpringBlade

Patch verifiedEPSS %11 mo ago

8.2

CVE-2026-59324

fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

VendorSpringProductSpring Integration+2 etkilenen

Patch status unknownEPSS %01 mo ago

6.3

CVE-2026-59322

EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

VendorSpringProductSpring Integration+2 etkilenen

Patch status unknownEPSS %01 mo ago

4.2

CVE-2026-59321

Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

VendorSpringProductSpring Integration+2 etkilenen

Patch status unknownEPSS %01 mo ago

6.5

CVE-2026-59320

In Spring AMQP the link credit never replenished on listener exception path

VendorSpringProductSpring AMQP+2 etkilenen

Patch status unknownEPSS %01 mo ago

4.3

CVE-2026-59319

RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure

VendorSpringProductSpring AI+2 etkilenen

Patch status unknownEPSS %01 mo ago

6.5

CVE-2026-59317

In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop

VendorSpringProductSpring for Apache Kafka+2 etkilenen

Patch status unknownEPSS %01 mo ago

8.2

CVE-2026-59316

Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

VendorSpringProductSpring Authorization Server+2 etkilenen

Patch status unknownEPSS %01 mo ago

5.3

CVE-2026-59315

Spring Cloud Config Monitor Denial of Service

VendorSpringProductSpring Cloud Config+2 etkilenen

Patch status unknownEPSS %01 mo ago

3.7

CVE-2026-59314

Spring Framework response splitting in ContentDisposition

VendorSpringProductSpring Framework+2 etkilenen

Patch status unknownEPSS %01 mo ago

Spring

12-month vulnerability rate

CVE severity distribution

Patch and exploitation view

Latest vulnerabilities

SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint

fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

In Spring AMQP the link credit never replenished on listener exception path

RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure

In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop

Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Cloud Config Monitor Denial of Service

Spring Framework response splitting in ContentDisposition

DayBreach

Glossary & Reference

Directories & Feeds

RSS & Integration