onyx

onyx --cves cve-2026-59283

CVE-2026-59283

CRITADV 1Spring Framework
score
4.7
cvss
9.1
epss
0.5%
published
2026-08-27
kev added
—
first seen

Spring Framework 5.2.25.RELEASE and earlier, 5.3.0 - 5.3.49, 6.0.0 - 6.0.30, 6.1.0 - 6.1.28, 6.2.0 - 6.2.19, and 7.0.0 - 7.0.8 contain a template injection caused by safety guard bypass in SpEL expression evaluation with active compiler, letting attackers execute arbitrary expressions, exploit requires use of SimpleEvaluationContext with compiler enabled.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2026-08-27 — PublishedP2026-10-16 — First advisory — CERT-FR (avis): Multiples vulnérabilités dans les produits IBM (16 octobre 2026)A2026-10-21 (seen by) — Tracked by OnyxTscore2026-10-21: score 4.74.7epss2026-09-22: epss 0.4%2026-09-23: epss 0.4%2026-09-24: epss 0.5%2026-09-25: epss 0.5%2026-09-26: epss 0.5%2026-09-27: epss 0.5%2026-09-29: epss 0.5%2026-09-30: epss 0.5%2026-10-01: epss 0.5%2026-10-02: epss 0.5%2026-10-03: epss 0.5%2026-10-04: epss 0.5%2026-10-05: epss 0.5%2026-10-06: epss 0.5%2026-10-07: epss 0.5%2026-10-08: epss 0.5%2026-10-09: epss 0.5%2026-10-10: epss 0.5%2026-10-11: epss 0.5%2026-10-12: epss 0.5%2026-10-13: epss 0.5%2026-10-14: epss 0.5%2026-10-15: epss 0.5%2026-10-16: epss 0.5%2026-10-18: epss 0.5%2026-10-19: epss 0.5%2026-10-20: epss 0.5%2026-10-21: epss 0.5%0.5%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. First advisory — CERT-FR (avis) Multiples vulnérabilités dans les produits IBM (16 octobre 2026)
  3. Tracked by Onyx

Advisories

1 feed this week

Weaknesses

CWE-913

References 1