https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2014-0054.htmlhttps://patchthecve.com/cve/CVE-2014-0054.htmlWed, 17 Jun 2026 00:02:10 +0000MEDIUM 6.8: The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External https://patchthecve.com/cve/CVE-2013-7315.htmlhttps://patchthecve.com/cve/CVE-2013-7315.htmlWed, 17 Jun 2026 00:01:44 +0000MEDIUM 6.8: The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, akahttps://patchthecve.com/cve/CVE-2013-4152.htmlhttps://patchthecve.com/cve/CVE-2013-4152.htmlTue, 16 Jun 2026 23:56:42 +0000MEDIUM 6.8: The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in cohttps://patchthecve.com/cve/CVE-2011-2730.htmlhttps://patchthecve.com/cve/CVE-2011-2730.htmlTue, 16 Jun 2026 23:31:53 +0000HIGH 7.5: VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrorshttps://patchthecve.com/cve/CVE-2012-1833.htmlhttps://patchthecve.com/cve/CVE-2012-1833.htmlTue, 16 Jun 2026 23:40:23 +0000MEDIUM 5.0: VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.