Spring Web Flow (Broadcom) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 59 known versions, newest CVE from 2026-06-11. Vendor: Broadcom.

CVEs of Spring Web Flow

• CVE-2026-40985 - CVSS 6.4 (medium), 2026-06-11: Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow…
• CVE-2026-40986 - CVSS 4.8 (medium), 2026-06-11: Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a…
• CVE-2017-8039 - CVSS 5.9 (medium), 2017-11-27: An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding…
• CVE-2017-4971 - CVSS 5.9 (medium), 2017-06-13: An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding…