boxscore/security
VENDOR · referenceVendors · latest edition

Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

Spring

Vendor reference — Spring · sector: Other. Cumulative disclosure record across the archive.

Follow Spring — Atom feed

Career totals

Disclosures & known-exploited
All-timeYTD
CVEs170170
KEV entries00
Rate & severity
KEV/100Med CVSSMed EPSSCHML
0.06.5.003313608314

KEV/100 = KEV entries ÷ CVEs × 100. Med CVSS / Med EPSS are medians over all disclosures. C/H/M/L = disclosures by CVSS severity band.

Monthly disclosures

Trend (by first-seen month, full archive): ▁▇▁█▁▁

Last 12 months (new CVEs by first-seen day)
MonthNew CVEs
2026-051
2026-0672
2026-076
2026-0891
2026-090
2026-100

Notable CVEs

Ranked by the published formula: KEV → EPSS → CVSS → CVE ID.

Notable (ranked)
CVECVSSEPSS %ileSeverityKEVFirst seen
CVE-2026-478649.893.0CRITICAL—2026-08-27
CVE-2026-409847.563.6HIGH—2026-06-09
CVE-2026-409837.556.7HIGH—2026-06-09
CVE-2026-418628.853.8HIGH—2026-06-23
CVE-2026-416999.850.7CRITICAL—2026-06-11
CVE-2026-417318.149.2HIGH—2026-06-09
CVE-2026-478849.847.1CRITICAL—2026-08-27
CVE-2026-478909.844.9CRITICAL—2026-08-27
CVE-2026-593139.844.9CRITICAL—2026-08-27
CVE-2026-478379.844.3CRITICAL—2026-08-26
CVE-2026-592797.544.0HIGH—2026-08-21
CVE-2026-592839.143.8CRITICAL—2026-08-27
CVE-2026-478929.842.8CRITICAL—2026-08-27
CVE-2026-478919.842.3CRITICAL—2026-08-27
CVE-2026-478947.539.7HIGH—2026-08-27

Recent CVEs

Most recently seen
CVECVSSEPSS %ileSeverityKEVFirst seen
CVE-2026-592897.537.7HIGH—2026-08-27
CVE-2026-592875.928.2MEDIUM—2026-08-27
CVE-2026-592868.123.6HIGH—2026-08-27
CVE-2026-592858.135.7HIGH—2026-08-27
CVE-2026-593143.715.6LOW—2026-08-27
CVE-2026-592983.512.0LOW—2026-08-27
CVE-2026-592887.429.0HIGH—2026-08-27
CVE-2026-593078.033.7HIGH—2026-08-27
CVE-2026-592754.936.6MEDIUM—2026-08-27
CVE-2026-592726.817.2MEDIUM—2026-08-27
CVE-2026-592775.319.3MEDIUM—2026-08-27
CVE-2026-592765.924.1MEDIUM—2026-08-27
CVE-2026-592847.634.7HIGH—2026-08-27
CVE-2026-592709.132.4CRITICAL—2026-08-27
CVE-2026-592973.52.5LOW—2026-08-27

Products

This vendor's products with a reference page (≥2 disclosures), by CVE count. A monolithic vendor total dilutes signal; product pages sharpen it.

Products (by CVE count)
ProductCVEsKEV
Spring Framework350
Spring Integration150
Spring Security140
Spring AI90
Spring Cloud Function80
Spring For GraphQL80
Spring AMQP70
Spring Web Services70
Reactor Netty60
Spring Data REST60
Spring Tools For Eclipse60
Spring Cloud Stream50
Spring For Apache Kafka50
Micrometer40
Spring Cloud Config40
Spring Data Commons40
Spring Batch30
Reactor Core20
Spring Authorization Server20
Spring Boot20
Spring Cloud Gateway20
Spring Data MongoDB20
Spring HATEOAS20
Spring Tools For VSCode / Cursor / Theia20
Spring Web Flow20

KEV entries

No entries in the CISA KEV catalog.

KEV timing

Fastest to KEV
CVEDays
—
Longest unpatched (KEV due date passed)
CVEDueDays over
—

Methodology

Rate statistics are arithmetic over published figures: KEV/100 = KEV entries ÷ CVEs × 100; medians are taken over this vendor's disclosures. Vendor names are normalized (case, punctuation, common aliases) before aggregation; monthly counts are keyed to first-seen day, the day this archive first observed the record, not the upstream publication date.

Raw counts are not comparable across vendors: disclosure practices, product breadth, and CNA conventions differ widely, so a larger number here does not mean less secure software. This is a reference page assembled from the public record — not a record of its own, and not a ranking of vendors by our judgment.

Sources. CVE records from the CVE Program (cvelistV5); enrichment from NVD (NIST); known-exploited status from the CISA KEV catalog; exploit probability from FIRST EPSS.