tag
Spel-Injection
Critical
Spring Cloud Gateway Actuator RCE — Vulnerable Environment Lab (CVE-2025-41243)
CVE-2025-41243·
Spring Cloud Gateway (spring-cloud-starter-gateway 4.1.0 on spring-boot-starter-parent 3.3.0), with Actuator's gateway endpoint exposed
unpatched
Critical
Thymeleaf SpEL Injection Remote Code Execution (CVE-2026-41901)
CVE-2026-41901·
Spring Boot application using Thymeleaf template engine
unpatched
Critical
Spring AI SimpleVectorStore SpEL Injection RCE (CVE-2026-22738)
CVE-2026-22738·
Spring AI spring-ai-core (SimpleVectorStore)
patched