{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:59741b6c-f21d-51d3-b176-edef24c2625c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1", "version": "5.3.6-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:f12d284a-9df7-56ba-82b5-fe56e989e253", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:7f1265ca-36b6-5b82-bfe2-5252a30cc625", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:797b51ce-674e-562e-9463-5d36aeaaf83b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:cf3d22e6-34dc-585a-8762-075a46427285", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:8758af05-e330-5a72-a019-56f33ce48d55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:c3a2716e-6ea0-5d32-8a98-eb00cde8b42e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:1953826e-071d-570d-90e8-9f07e6fe2200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:1d7a3eb2-0aa2-5ef2-a695-4172cc1db887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:835b5bd6-08bf-53a3-95dc-253d1d352274", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:94fc9c04-cde6-5207-b166-472cbb2e6b57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:8fbfad3b-7501-524d-a427-a8ff636cb97b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:6e0e83fb-88cb-5e00-baa4-993b5251dd94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:5ba2061e-df9a-5963-a10b-be4a40a0ef9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:88e6459b-adde-52b9-b303-6b07551b28c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:037c0b82-df06-5f6c-96e1-2b44f1cb7114", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:fed5c2c5-6e9c-5e33-a9d1-ccf3d732b7fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:f7af3cce-18ee-5696-8e84-fd496d6f03d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:b3932078-40c3-5e96-86c6-cbb4f2f1ec57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:d5420c24-1ca0-5371-90ef-42a00ef1ef44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:82e38b1a-f97a-5e2a-84f7-e5c8d09e70d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.3.6-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 5.3.6 is not affected by CVE-2024-38820. The vulnerability concerns locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, which was introduced by the CVE-2022-22968 fix in version 5.3.7. Version 5.3.6 predates this fix and performs case-sensitive field name matching only, without any toLowerCase() calls in the affected code paths.", "justification": "code_not_present" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:e0681128-2e3f-5ef8-8037-070f89de1037", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:f2bc22e6-ae44-5c5f-8b43-73c48e3f90f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:78e137a6-4d90-5ac0-9b30-dd9647de877b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:966e13a7-83b4-5b18-8277-be658c6a6e96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:2ff4fb49-7843-52ac-87d2-c1ece67023b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:734a985b-486c-52ba-9cb0-d586dd0518c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:3b7cb2d7-c1e9-52ac-864b-a5989034ed2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:43509486-0bd2-53da-9909-a74aa492a234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:4dd4ba18-c77e-5f1e-8cba-c18027d08332", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:2aa0a97b-ccf3-59c5-a835-941b5c4f7688", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:3fa61765-190d-593d-a6ae-eab9e54ca804", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:63a5a503-c9cb-520b-a36e-eb93ed467c5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:820ece09-1f35-5743-a399-33efaac1667f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:1d70391c-bf37-5e4a-b13a-8e4de4783ad5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:60c9b23f-4064-5317-b543-02d947b82f18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:5afdd7df-d080-56a8-8e5a-4d7819adb2b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:cdf9d414-3420-54c8-9c73-6b451b486880", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:71be28a6-b1f3-55e1-8c76-007ff01f734e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:f4718376-87db-5406-9903-da8d6bdbbff4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:85efea6f-a671-58cc-b0e8-4858575a751d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:f46ead19-d209-5e16-8929-7a816cff8602", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:95b1bc26-b354-5332-9632-db929ac7488c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:bc44045e-581f-55d0-8e47-e03db2a95668", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:fdcc5032-89a6-5385-83aa-918a09a414e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:e8609b88-03f4-554c-9616-5d7b67f603e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:44353b62-fa59-5fad-b469-db1b2b03e2ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:f59d5065-8990-5f27-ba00-1bf3a92aa4c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:b7d34390-6123-50e9-b6ba-35bfed9f590a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:db9a91b8-7d33-5363-9d4c-023ebd8c971e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:ba7672c0-40f9-5c62-b72b-fe67c6f5cefa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:2cf44a35-2267-5483-8307-d11d348e9a1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:efefcd1f-137b-5d02-8be2-23a1536e2c9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:1a6de27a-fbbd-593b-9850-f66a6fc52624", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:6560638c-a077-5513-80fa-d93d4942a227", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:132a84e4-25c4-540d-a359-5ecc92000471", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:9ce88734-ee22-58a7-8e7e-339b63bce8b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:d1480548-9323-581b-847c-5d12e085f5e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:cafb50b1-834d-5812-b02c-e38ee27ac7f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:122de497-fcbf-5a1d-a590-4c79d8e9d2e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:3f05a485-f96f-51f3-9fe1-b27ac875892a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ], "bom-ref": "urn:uuid:955094a1-b692-53c7-948e-9ce2a0399b06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.6-tuxcare.1 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.6-tuxcare.1" } ] }