CVE-2026-41008Medium· 6.1▾ SunlitSpring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unva…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.3%
Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, which can lead to an Open Redirect vulnerability.
Affected versions: Spring Security 7.0.0 through 7.0.5. Spring Authorization Server 1.5.0 through 1.5.7.
spring_authorization_server >= 1.5.0, < 1.5.7.1spring_security >= 7.0.0, < 7.0.5.1Upgrade past the affected range:
spring_authorization_server 1.5.7.1spring_security 7.0.5.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-22752Critical· 9.6Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1…
CVE-2024-0953Medium· 6.1When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code
CVE-2025-3155High· 7.4A flaw was found in Yelp
CVE-2026-101034Medium· 6.8Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials
CVE-2026-19810Medium· 5.4Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cross-Site Scripting (XSS) vulnerability, which is a type of issue whereby an attacker may attempt to inject malicious script that executes i…
CVE-2026-87428High· 7.8In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocad…