# Vmware Spring Framework


- [CVE-2022-22965](https://insights.sbomify.com/CVE-2022-22965/): Spring Framework JDK 9+ Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2026-47884](https://insights.sbomify.com/CVE-2026-47884/): Spring Framework Improper Path Limitation in XsltView (critical 9.8)
- [CVE-2026-47890](https://insights.sbomify.com/CVE-2026-47890/): Spring Framework Server Sent Event stream corruption while rendering fragments (critical 9.8)
- [CVE-2026-47891](https://insights.sbomify.com/CVE-2026-47891/): Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder (critical 9.8)
- [CVE-2026-47892](https://insights.sbomify.com/CVE-2026-47892/): Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints (critical 9.8)
- [CVE-2026-59313](https://insights.sbomify.com/CVE-2026-59313/): Server Sent Event stream corruption in Spring MVC functional web framework (critical 9.8)
- [CVE-2016-1000027](https://insights.sbomify.com/CVE-2016-1000027/): Pivotal Spring Framework contains unsafe Java deserialization methods (critical 9.8)
- [CVE-2018-1275](https://insights.sbomify.com/CVE-2018-1275/): Spring Framework has Improperly Implemented Security Check for Standard (critical 9.8)
- [CVE-2018-1270](https://insights.sbomify.com/CVE-2018-1270/): Spring Framework allows applications to expose STOMP over WebSocket endpoints (critical 9.8)
- [CVE-2015-5211](https://insights.sbomify.com/CVE-2015-5211/): Files or Directories Accessible to External Parties in org.springframework:spring-core (critical 9.6)
- [CVE-2026-59283](https://insights.sbomify.com/CVE-2026-59283/): Spring Framework Safety Guard Bypass via SpEL Expression Compilation (critical 9.1)
- [CVE-2018-1258](https://insights.sbomify.com/CVE-2018-1258/): Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/products/vmware/spring-framework/