CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,202 CVEs published, 242 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,202
Show in the list
Critical, last 7 days
242
Show in the list
Healthcare-tagged, last 7 days
8
Show in the list
Known exploited (CISA KEV)
1,760
Show in the list

Showing CVEs that name the product vmware:spring_boot. Show all products

12 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-41001Medium 5.3Predictable Temp Directory in Artemis Auto-configuration
Assigned by vmware
Jun 11, 2026
CVE-2026-40992Medium 5.0Mail Auto-Configuration Does Not Enable SSL Hostname Verification
Assigned by vmware
Jun 11, 2026
CVE-2026-40977Medium 4.7When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is starte…
Assigned by vmware
Apr 27, 2026
CVE-2026-40976Critical 9.1In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints.
Assigned by vmware
Apr 27, 2026
CVE-2026-40975Medium 4.8Values produced by ${random.value} are not suitable for use as secrets.
Assigned by vmware
Apr 27, 2026
CVE-2026-40974Medium 5.0Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.
Assigned by vmware
Apr 27, 2026
CVE-2026-40973High 7.0A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`.
Assigned by vmware
Apr 27, 2026
CVE-2026-40972High 7.5An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret.
Assigned by vmware
Apr 27, 2026
CVE-2026-40971Medium 5.0When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.
Assigned by vmware
Apr 27, 2026
CVE-2026-40970Medium 5.0When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.
Assigned by vmware
Apr 27, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.