Spring-Boot

Alibaba Fastjson 1.x checkAutoType Bypass to Remote Code Execution via jar:http SSRF and fd-Reread Trick (CVE-2026-16723) new EPSS 16%CVE-2026-16723webCRITICAL 9Unpatched2026-07-31camel-coap Header Injection → RCE Self-Contained Reproducer (CVE-2026-33453) newCVE-2026-33453webCRITICAL 9.8Unverified2026-07-06Apache Camel `camel-consul` ConsulRegistry Deserialization RCE (CVE-2026-27172) newCVE-2026-27172webCRITICAL 9.8Patched2026-07-06Thymeleaf SpEL Injection Remote Code Execution (CVE-2026-41901) newCVE-2026-41901webCRITICALPatched2026-07-05Spring Security Lazy Header Writing Security Header Bypass (CVE-2026-22732) newCVE-2026-22732webCRITICAL 9.1Patched2026-07-05