https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-47881.htmlhttps://patchthecve.com/cve/CVE-2026-47881.htmlTue, 01 Sep 2026 20:21:10 +0000MEDIUM 5.9: Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume exchttps://patchthecve.com/cve/CVE-2026-47878.htmlhttps://patchthecve.com/cve/CVE-2026-47878.htmlThu, 10 Sep 2026 15:28:35 +0000MEDIUM 5.6: DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlierhttps://patchthecve.com/cve/CVE-2026-47875.htmlhttps://patchthecve.com/cve/CVE-2026-47875.htmlWed, 02 Sep 2026 15:31:14 +0000MEDIUM 5.6: Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attac