These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-41838 is a medium severity vulnerability in the Spring Framework. The IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. This vulnerability affects Spring Framework versions 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.
CVE-2026-41720 is a high-severity vulnerability in Spring LDAP's DirContextAuthenticationStrategy implementations. The vulnerability occurs when a non-empty username is paired with an empty or null password, allowing an authentication bypass. Affected versions include Spring LDAP 2.4.0 through 2.4.4, 3.2.0 through 3.2.17, 3.3.0 through 3.3.7, and 4.0.0 through 4.0.3.
CVE-2026-41715 is a medium-severity vulnerability (CVSS Score: 6.1) affecting Reactor Netty's HTTP client. In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. This can occur only when the HTTP client has been explicitly configured to follow redirects. Affected versions include Reactor Netty 1.0.0 through 1.0.51, 1.1.0 th [truncated]
CVE-2026-41710 is a medium-severity vulnerability affecting Spring Retry versions 2.0.0 through 2.0.12 and 1.3.0 through 1.3.4. An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the [truncated]
CVE-2026-41007 is a high-severity vulnerability in Spring HATEOAS, a library for building RESTful web services. The vulnerability allows for a denial-of-service (DoS) attack due to an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.
A high-severity vulnerability, CVE-2026-41006, was found in Spring HATEOAS, affecting versions 1.5.0 through 1.5.6, 2.3.0 through 2.3.4, 2.4.0 through 2.4.1, 2.5.0 through 2.5.2, and 3.0.0 through 3.0.3. The vulnerability is caused by the internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performing bean property binding via reflection [truncated]
Micrometer users should assess exposure to denial-of-service (DoS) conditions via specially crafted HTTP requests. Affected versions include micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17 and micrometer-jetty11 and micrometer-jetty12 with similar version ranges. Defenders should verify inventory, review vendor remediation [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-09T05:16:34.653Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. This denial-of-service vulnerability in Micrometer, tracked as CVE-2026-40983, affects versions 1.16.0 through 1.16.5 and 1.15.0 through 1.15.11. Defenders should assess exposure and prioritize verif [truncated]
Spring AI versions 1.1.0 through 1.1.x contain a path traversal vulnerability in their Anthropic Skills API integration. The application uses LLM-influenced filenames without sanitization when calling Path.resolve() before writing files to disk, allowing authenticated attackers to write files outside the intended target directory. This could enable writing to restricted system directories, potentially lea [truncated]
CVE-2026-41705 affects Spring AI's MilvusVectorStore#doDelete(List) path, where unsanitized document IDs can be used to inject filter expressions. The vendor guidance says Spring AI 1.0.x should be upgraded to 1.0.7 or later, and Spring AI 1.1.x should be upgraded to 1.1.6 or later.
CVE-2026-40982 is a critical vulnerability in VMware Spring Cloud Config, allowing directory traversal attacks. Affected versions include 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x. Malicious users or attackers can send specially crafted URLs to exploit this vulnerability. Upgrades to 3.1.14, 4.1.10, 4.2.7, 4.3.3, or 5.0.3 are recommended for affected versions. This vulnerability has a CVSS score of 9.1 and is [truncated]
CVE-2026-40981 is a high-severity vulnerability in VMware Spring Cloud Config that could allow exposure of secrets from unintended GCP projects when using Google Secrets Manager as a backend. The vulnerability affects multiple versions of Spring Cloud Config, including 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x. To mitigate this vulnerability, users should upgrade to the latest version of Spring Cloud Config. [truncated]
CVE-2026-40976 is a critical vulnerability in Spring Boot that allows unauthorized access to all endpoints. The vulnerability exists when an application is a servlet-based web application, has no Spring Security configuration of its own, relies on the default web security filter chain, depends on spring-boot-actuator-autoconfigure, and does not depend on spring-boot-health. Affected versions include Sprin [truncated]
CVE-2026-40975 is a medium-severity vulnerability affecting Spring Boot, a popular Java framework for building web applications. The issue arises from the insecure generation of random numbers, which can be used as secrets. Specifically, the ${random.value} function produces values that are not suitable for use as secrets. Additionally, ${random.int} and ${random.long} should not be used for secrets due t [truncated]
A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user. The vulnerabilit [truncated]
CVE-2026-40972 is a high-severity vulnerability in VMware Spring Boot that allows an attacker to discover the remote secret via a timing attack, potentially leading to remote code execution. The vulnerability affects multiple versions of Spring Boot, including 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, and 2.7.0-2.7.32. This vulnerability is caused by a timing attack vulnerability in the DevTo [truncated]