CVE-20XX-?

VMware Spring Framework CVEs.

Published CVEs affecting VMware Spring Framework, ranked by exploit odds.

3 CVEs · updated 2026-11-06 06:22 UTC

Reset all
  1. CVE-2026-47892

    A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE

    Auth & access VMware Spring Framework

    9.8 CRITICAL 0.5% exploit odds Fix listed
  2. CVE-2026-41852

    A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

    Auth & access VMware Spring Framework

    3.7 LOW 0.2% exploit odds Fix listed
  3. CVE-2026-41847

    Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48.

    Auth & access Network gear VMware Spring Framework

    4.8 MEDIUM 0.2% exploit odds Fix listed

All CVEs affecting VMware Spring Framework that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.