Maven org.springframework:spring-core

Name: Maven org.springframework:spring-core
Brand: Maven

productUS

pkg:maven/org.springframework/spring-core

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

unpatched

by severity

1critical8high9medium0low

updated 2026-10-28

vulnerabilities (19)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2011-2894US	medium6.8	8.60% (95th)	Exploit	3.0.6	2011-10-04	3.0.0 → 3.0.6
CVE-2025-41249US	—OT elevated	0.48% (41st)	Exploit	6.2.11	2025-09-16	3 versions
CVE-2018-1271US	medium5.9	30.3% (98th)	—	4.3.15	2018-04-06	2 versions
CVE-2011-2730US	high7.5	11.8% (96th)	—	2.5.7.SR023	2012-12-05	3 versions
CVE-2018-15756US	high7.5	8.80% (95th)	—	5.1.1.RELEASE	2018-10-18	3 versions
CVE-2014-3578US	medium5.0	6.39% (94th)	—	3.2.9	2015-02-19	2 versions
CVE-2018-11040US	high7.5	3.23% (88th)	—	5.0.7.RELEASE	2018-06-25	2 versions
CVE-2018-1272US	high7.5	3.06% (88th)	—	5.0.5	2018-04-06	2 versions
CVE-2018-1257US	medium6.5	3.02% (87th)	—	4.3.17	2018-05-11	2 versions
CVE-2018-1199US	medium5.3	2.80% (86th)	—	5.0.3	2018-03-16	2 versions
CVE-2016-5007US	high7.5	2.80% (86th)	—	4.3.1	2017-05-25	< 4.3.1
CVE-2009-1190US	medium5.0	2.80% (86th)	—	3.0.0.RELEASE	2009-04-27	1.1.0 → 3.0.0.RELEASE
CVE-2015-5211US	critical9.6	2.56% (85th)	—	4.1.8	2017-05-25	3 versions
CVE-2018-1258US	high8.8OT elevated	2.46% (84th)	—	5.0.6.RELEASE	2018-05-11	5.0.5.RELEASE → 5.0.6.RELEASE
CVE-2015-0201US	medium5.0	1.90% (80th)	—	4.1.5	2015-03-10	4.1.0 → 4.1.5
CVE-2021-22096US	medium4.3	1.35% (71st)	—	5.3.11	2021-10-28	2 versions
CVE-2024-22233US	high7.5	1.05% (64th)	—	6.1.3	2024-01-22	2 versions
CVE-2021-22060US	medium4.3	0.85% (58th)	—	5.2.19	2022-01-10	2 versions
CVE-2026-41848US	high7.5	0.34% (27th)	—	6.2.19	2026-06-09	4 versions

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation3 CVEs
CWE-117Improper Output Neutralization for Logs2 CVEs
CWE-1333Inefficient Regular Expression Complexity2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-254CWE-2542 CVEs
CWE-285Improper Authorization2 CVEs
CWE-399CWE-3992 CVEs
CWE-863Incorrect Authorization2 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.