Skip to content
OpenAdvisories

Product · Spring

Spring Boot

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-40976

    Spring Boot's default security filter chain has no authorization rule with Actuator but without Health

    In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and r…

    Spring Spring Boot org.springframework.boot:spring-boot Maven