CVE-2026-40993High· 7.3▾ TwilightAn attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of veri…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.3%
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).
Affected versions: Spring Security 7.0.0 through 7.0.5.
spring_security >= 7.0.0, < 7.0.5.1Upgrade past the affected range:
spring_security 7.0.5.1Connected by shared product, vendor, weakness, or advisory.
CVE-2016-1000027Critical· 9.8Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data
CVE-2026-41707High· 7.4Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability
CVE-2026-47856Medium· 6.3Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration…
CVE-2018-1258High· 8.8Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security
CVE-2026-41699High· 8.1Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries
CVE-2026-41732High· 8.1JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages