Maven org.springframework.cloud:spring-cloud-config-server

Name: Maven org.springframework.cloud:spring-cloud-config-server
Brand: Maven

productUS

pkg:maven/org.springframework.cloud/spring-cloud-config-server

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

unpatched

critical

by severity

0critical2high2medium0low

updated 2026-10-27

vulnerabilities (8)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2020-5410US	high7.5OT critical	95.6% (100th)	KEV	2.1.9	2020-06-02	2 versions
CVE-2019-3799US	medium6.5	85.3% (100th)	Exploit	2.0.4	2019-05-06	3 versions
CVE-2020-5405US	medium6.5	68.5% (99th)	Exploit	2.1.7	2020-03-05	2 versions
CVE-2026-40982US	—	0.73% (54th)	Exploit	4.3.3	2026-05-07	5 versions
CVE-2026-22739US	—	1.22% (69th)	—	4.3.2	2026-03-24	5 versions
CVE-2026-40981US	—	0.43% (38th)	—	5.0.3	2026-05-07	5 versions
CVE-2026-41002US	high8.1	0.22% (12th)	—	5.0.3	2026-05-07	6 versions
CVE-2026-41004US	—	0.17% (6th)	—	5.0.3	2026-05-07	6 versions

The flaw types (CWEs) most of these CVEs share.

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')5 CVEs
CWE-23Relative Path Traversal2 CVEs
CWE-1220Insufficient Granularity of Access Control1 CVEs
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition1 CVEs
CWE-532Insertion of Sensitive Information into Log File1 CVEs
CWE-639Authorization Bypass Through User-Controlled Key1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.