今日共收录 1730 条安全情报，包含 831 个 CVE，478 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CVE-2026-41714
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also c
CVE-2026-41711
Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowE
CVE-2026-41706
Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser
CVE-2026-41701
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to int
CVE-2026-41697
Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (
CVE-2026-41696
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient
CVE-2026-41695
Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-contro
CVE-2026-41694
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses withou
CVE-2026-41008
Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parame
CVE-2026-41003
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generat
CVE-2026-40993
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_assertin
CVE-2026-40991
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an
CVE-2026-40988
An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be
CVE-2026-9754
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted is
CVE-2026-9753
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed
CVE-2026-9752
An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSO
CVE-2026-9751
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mon
CVE-2026-9750
An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfe
CVE-2026-9748
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index st
CVE-2026-9743
In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines