https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T15:07:56.310736+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-01631 bdu:2022-01631 2026-10-02T15:07:56.519173+00:00 bdu:2022-01631 https://cve.radiocsirt.org/vuln/certfr-2022-avi-297 certfr-2022-avi-297 — Une vulnérabilité a été découverte dans VMware Spring. Elle permet à un attaquant de provoquer une exécution de code ar… 2026-10-02T15:07:56.519229+00:00 certfr-2022-avi-297 https://cve.radiocsirt.org/vuln/cisco-sa-java-spring-rce-zx9guc67 cisco-sa-java-spring-rce-Zx9GUc67 — Vulnerability in Spring Framework Affecting Cisco Products: March 2022 2026-10-02T15:07:56.519268+00:00

On March 31, 2022, the following critical vulnerability in the Spring Framework affecting Spring MVC and Spring WebFlux applications running on JDK 9+ was released: CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+ For a description of this vulnerability, see VMware Spring Framework Security Vulnerability Report ["https://tanzu.vmware.com/security/cve-2022-22965"].

 https://cve.radiocsirt.org/vuln/euvd-2026-255853 EUVD-2026-255853 2026-10-02T15:07:56.519300+00:00 EUVD-2026-255853 https://cve.radiocsirt.org/vuln/fkie_cve-2022-22965 fkie_cve-2022-22965 2026-10-02T15:07:56.519313+00:00

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

 https://cve.radiocsirt.org/vuln/ghsa-36p3-wjmg-h94x GHSA-36p3-wjmg-h94x — Remote Code Execution in Spring Framework 2026-10-02T15:07:56.519336+00:00

Affected: Maven: org.springframework:spring-beans, Maven: org.springframework:spring-webmvc, Maven: org.springframework.boot:spring-boot-starter-web, Maven: org.springframework:spring-webflux, Maven: org.springframework.boot:spring-boot-starter-webflux

Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as `Spring4Shell`.

## Impact

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

These are the prerequisites for the exploit: - JDK 9 or higher - Apache Tomcat as the Servlet container - Packaged as WAR - `spring-webmvc` or `spring-webflux` dependency

## Patches

- Spring Framework [5.3.18](https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18) and [5.2.20](https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE) - Spring Boot [2.6.6](https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6) and [2.5.12](https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12)

## Workarounds

For those who are unable to upgrade, leaked reports recommend setting `disallowedFields` on `WebDataBinder` through an `@ControllerAdvice`. This works generally, but as a centrally applied workaround fix, may leave some loopholes, in particular if a controller sets `disallowedFields` locally through its own `@InitBinder` method, which overrides the global…

 https://cve.radiocsirt.org/vuln/gsd-2022-22965 gsd-2022-22965 2026-10-02T15:07:56.519388+00:00 gsd-2022-22965 https://cve.radiocsirt.org/vuln/icsa-22-286-05 ICSA-22-286-05 — Hitachi Energy Lumada Asset Performance Management Prognostic Model Executor Service 2026-10-02T15:07:56.519401+00:00

A vulnerability exists in the Spring Framework component included in the Prognostic Model Executor service of the affected product. An attacker could exploit this vulnerability by sending a specially crafted data or configuration to the application either directly or via integrated applications, causing the Prognostic Model Executor service to fail.CVE-2022-22950 has been assigned to this vulnerability. A CVSS v3 base score of 3.1 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L). A vulnerability in the Spring Framework component included in the Prognostic Model Executor service could allow an attacker to inject arbitrary code for remote code execution.CVE-2022-22965 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

 https://cve.radiocsirt.org/vuln/rhsa-2022:1306 RHSA-2022:1306 — Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.2.1-1 security update 2026-10-02T15:07:56.519423+00:00

spring-framework: RCE via Data Binding on JDK 9+

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-22965 UBUNTU-CVE-2022-22965 2026-10-02T15:07:56.519439+00:00

Affected: Ubuntu:Pro:18.04:LTS: libspring-java, Ubuntu:Pro:20.04:LTS: libspring-java, Ubuntu:Pro:22.04:LTS: libspring-java, Ubuntu:Pro:24.04:LTS: libspring-java, Ubuntu:25.10: libspring-java

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0033 WID-SEC-W-2022-0033 — VMware Tanzu Spring Framework: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode 2026-10-02T15:07:56.519465+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Framework ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.