How many vmware spring data rest CVEs are in CISA KEV?

Yes — 1 of vmware spring data rest's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which versions of vmware spring data rest are affected?

23 distinct vmware spring data rest versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in vmware spring data rest CVEs?

vmware spring data rest's CVEs most often map to these CWE weakness types: CWE-284 (Improper Access Control), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-209 (Generation of Error Message Containing Sensitive Information), CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')).

How many critical vmware spring data rest vulnerabilities are there?

vmware spring data rest has 2 critical and 4 high-severity CVEs.

What is the average severity of vmware spring data rest CVEs?

The average CVSS base score across vmware spring data rest's scored CVEs is 6.9.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

vmware

10 CVEs

1 in CISA KEV

vmware spring data rest Vulnerabilities

Name: vmware spring data rest vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for spring data rest by vmware.

10

Total CVEs

Published

1

In CISA KEV

Exploited in the wild

3

Public exploits

PoC or exploit code

6.9

Avg CVSS

2018–2026

Last updated June 9, 2026

Overview

vmware spring data rest has 10 published CVE records since 2018, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 3 have a known public exploit. The average CVSS base score across scored CVEs is 6.9.

This page aggregates every publicly disclosed vulnerability (CVE) affecting vmware spring data rest, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of vmware spring data rest's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High4

Medium3

Low1

In CISA’s Known Exploited Vulnerabilities catalog

1

One of vmware spring data rest's CVEs is confirmed exploited in the wild.

Public exploits

3

3 of vmware spring data rest's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every vmware spring data rest version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

3.7.0 <= v < 3.7.204 CVEs
4.3.0 <= v < 4.3.174 CVEs
4.4.0 <= v < 4.4.154 CVEs
4.5.0 <= v < 4.5.11.14 CVEs
5.0.0 <= v < 5.0.5.14 CVEs
< 2.6.91 CVE
<= 2.5.101 CVE
2.6 <= v <= 2.6.101 CVE
2.6 <= v <= 2.6.111 CVE
2.6.0 <= v <= 2.6.101 CVE
3.0.0 <= v <= 3.0.01 CVE
3.4.0 <= v <= 3.4.131 CVE
3.5.0 <= v <= 3.5.51 CVE
3.6.0 <= v < 3.6.71 CVE
3.7.0 <= v < 3.7.31 CVE

Fixed in

3.7.204 CVEs
4.3.174 CVEs
4.4.154 CVEs
4.5.11.14 CVEs
5.0.5.14 CVEs
2.6.91 CVE
3.6.71 CVE
3.7.31 CVE

Find a version

10 CVEs

Sort

Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys
CVE-2026-41837
Patch
CWE-284
Medium · CVSS 5.3
EPSS 0.2% (9th pct)2026-06-09
Spring Data REST exposes persistence-layer internals in error responses
CVE-2026-41730
Patch
CWE-209
Medium · CVSS 5.3
EPSS 0.2% (10th pct)2026-06-09
Spring Data REST SpEL Injection via Map Key in JSON Patch
CVE-2026-41729
Patch
CWE-917
High · CVSS 8.1
EPSS 0.4% (32th pct)2026-06-09
Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
CVE-2026-41728
Patch
CWE-284
High · CVSS 7.5
EPSS 0.3% (23th pct)2026-06-09
Low vulnerability · 2022-09-21
CVE-2022-31679
Patch
Low · CVSS 3.7
EPSS 0.5% (39th pct)2022-09-21
Medium vulnerability · 2021-10-28
CVE-2021-22047
Patch
CWE-200
Medium · CVSS 5.3
EPSS 0.7% (51th pct)2021-10-28
High vulnerability · 2018-05-11
CVE-2018-1259
Public exploit
Patch
High · CVSS 7.5
EPSS 5.0% (91th pct)2018-05-11
High vulnerability · 2018-04-18
CVE-2018-1274
Patch
High · CVSS 7.5
EPSS 2.0% (78th pct)2018-04-18
Critical vulnerability · 2018-04-11
CVE-2018-1273
CISA KEV
Public exploit
Patch
CWE-94
Added to CISA KEV 2022-03-25
Critical · CVSS 9.3
EPSS 95.6% (100th pct)2018-04-11
Critical vulnerability · 2018-01-04
CVE-2017-8046
Public exploit
Patch
Critical · CVSS 9.8
EPSS 74.4% (99th pct)2018-01-04

Common weakness types

The CWE weakness categories most often found in vmware spring data rest CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many vmware spring data rest CVEs were published each year.

2018

4

2021

1

2022

1

2026

4

Other vmware products

Browse vulnerabilities for other products by vmware.

workstation229 CVEs cloud foundation153 CVEs esxi146 CVEs fusion137 CVEs player89 CVEs esx86 CVEs vcenter server81 CVEs spring framework74 CVEs

All vmware vulnerabilities

Frequently asked questions

Common questions about vmware spring data rest vulnerabilities.

How many CVEs does vmware spring data rest have?: vmware spring data rest has 10 published CVE records since 2018.
How many vmware spring data rest CVEs are in CISA KEV?: Yes — 1 of vmware spring data rest's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for vmware spring data rest vulnerabilities?: Yes — 3 of vmware spring data rest's CVEs have a known public exploit.
Which versions of vmware spring data rest are affected?: 23 distinct vmware spring data rest versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in vmware spring data rest CVEs?: vmware spring data rest's CVEs most often map to these CWE weakness types: CWE-284 (Improper Access Control), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-209 (Generation of Error Message Containing Sensitive Information), CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')).
How many critical vmware spring data rest vulnerabilities are there?: vmware spring data rest has 2 critical and 4 high-severity CVEs.
What is the average severity of vmware spring data rest CVEs?: The average CVSS base score across vmware spring data rest's scored CVEs is 6.9.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track vmware spring data rest vulnerabilities

Monitor new vmware spring data rest vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing