How many CVEs does spring-projects have?

spring-projects has 248 published CVE records since 2010, including 122 in the last two years.

How many spring-projects CVEs are in CISA KEV?

Yes — 2 of spring-projects's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which spring-projects products have the most CVEs?

The spring-projects products with the most published CVEs are spring-framework, spring-security, org.springframework:spring-webmvc, org.springframework.security:spring-security-core, org.springframework:spring-webflux.

What are the most common weakness types in spring-projects CVEs?

spring-projects's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-502 (Deserialization of Untrusted Data), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

How many critical spring-projects vulnerabilities are there?

spring-projects has 31 critical and 93 high-severity CVEs.

What is the average severity of spring-projects CVEs?

The average CVSS base score across spring-projects's scored CVEs is 6.9.

spring-projects Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: spring-projects vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

spring-projects has 248 published CVE records since 2010, of which 2 are in CISA's Known Exploited Vulnerabilities catalog and 8 have a known public exploit. The average CVSS base score across scored CVEs is 6.9.

This page aggregates every publicly disclosed vulnerability (CVE) affecting spring-projects products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on spring-projects's vulnerability posture, as a share of its 248 published CVEs.

Average CVSS: 6.9
Critical / high: 50%
Actively exploited (KEV): 1%
Public exploit available: 3%
Patch available: 100%

Severity and exploitation

How the CVSS severity of spring-projects's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical31

High93

Medium116

Low8

In CISA’s Known Exploited Vulnerabilities catalog

2 of spring-projects's CVEs are confirmed exploited in the wild.

Public exploits

8 of spring-projects's CVEs have a known public exploit available.

Most affected products

The spring-projects products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in spring-projects CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish spring-projects CVE records.

Disclosure activity by year

How many spring-projects CVEs were published each year.

2019

2020

2021

2022

2023

2024

2025

Latest spring-projects CVEs

The most recently disclosed vulnerabilities affecting spring-projects.

Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check
CWE-362
Medium · CVSS 5.4
EPSS 0.1%2026-08-27
In Spring AMQP the link credit never replenished on listener exception path
CWE-772
Medium · CVSS 6.5
EPSS 0.3%2026-08-27
RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure
CWE-943
Medium · CVSS 4.3
EPSS 0.2%2026-08-27
Spring Framework response splitting in ContentDisposition

Other vendors

Browse vulnerabilities for other tracked vendors.

Zephyr Project245 CVEs OpenText244 CVEs Trendnet239 CVEs golang237 CVEs TIBCO237 CVEs Hitachi236 CVEs OpenEMR234 CVEs Linksys233 CVEs

Browse all vendors

Frequently asked questions

Common questions about spring-projects vulnerabilities.

How many CVEs does spring-projects have?: spring-projects has 248 published CVE records since 2010, including 122 in the last two years.
How many spring-projects CVEs are in CISA KEV?: Yes — 2 of spring-projects's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which spring-projects products have the most CVEs?: The spring-projects products with the most published CVEs are spring-framework, spring-security, org.springframework:spring-webmvc, org.springframework.security:spring-security-core, org.springframework:spring-webflux.
What are the most common weakness types in spring-projects CVEs?: spring-projects's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-502 (Deserialization of Untrusted Data), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).
Are there public exploits for spring-projects vulnerabilities?: Yes — 8 of spring-projects's CVEs have a known public exploit.
How many critical spring-projects vulnerabilities are there?: spring-projects has 31 critical and 93 high-severity CVEs.
What is the average severity of spring-projects CVEs?: The average CVSS base score across spring-projects's scored CVEs is 6.9.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track spring-projects vulnerabilities

Monitor new spring-projects vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing