CVE-2026-22731High
Spring Boot Actuator
fastjson
- Affected products
- Affected version
- —
- Status
- Fixed
- Published
- 2026-06-01
- Discovered
- 2026-03-18
Product Vulnerability List
This page lists known security vulnerabilities of Cloudwise products, their impact scope and affected service distribution, helping you stay informed and plan upgrades to keep your systems secure.
Last updated: Aug 12, 2026
Vulnerability Management Policy
We are committed to continuously tracking and fixing security vulnerabilities in our products and providing transparent disclosure.
- Discovery: Vulnerability information is gathered through internal security audits, external scans, and customer feedback.
- Severity grading: Based on CVSS / VPR scores, vulnerabilities are graded as Critical, High, Medium, and Low.
- Impact scope: Impact is annotated by affected products and versions for easier triage and scheduling.
- Data source: Vulnerability data is managed in Feishu; updating data only requires a data sync with no page changes.
10 vulnerabilities
CVE-2026-22733High
Authentication Bypass under Actuator CloudFoundry endpoints
Spring Security
- Affected products
- Affected version
- —
- Status
- Fixed
- Published
- 2026-06-01
- Discovered
- 2026-03-18
CVE-2022-25845High
Deserialization of Untrusted Data
fastjson
- Affected products
- Affected version
- —
- Status
- Fixed
- Published
- 2026-07-30
- Discovered
- 2022-06-09
CVE-2025-27818High
Apache Kafka Client LdapLoginModule Configuration Code Execution Vulnerability (CVE-2025-27818)
Apache Kafka
- Affected products
- Affected version
- 5.x (kafka-clients 3.8.0)
- Status
- Fixed
- Published
- 2026-01-16
- Discovered
- 2025-06-08
CVE-2025-27817High
Apache Kafka Client Arbitrary File Read and SSRF Vulnerability (CVE-2025-27817)
Apache Kafka
- Affected products
- Affected version
- 5.x (kafka-clients 3.8.0)
- Status
- Fixed
- Published
- 2026-01-16
- Discovered
- 2025-06-09
CVE-2024-38816High
Spring Framework Conditional Directory Traversal Vulnerability (CVE-2024-38816)
Spring Framework
- Affected products
- Affected version
- 5.x (spring 5.3.39, Nacos)
- Status
- Fixed
- Published
- 2026-01-16
- Discovered
- 2024-09-12
CVE-2024-38819High
Spring Framework Conditional Directory Traversal Vulnerability (CVE-2024-38819)
Spring Framework
- Affected products
- Affected version
- 5.x (spring 5.3.39, Nacos)
- Status
- Fixed
- Published
- 2026-01-16
- Discovered
- 2024-12-18
CVE-2024-38821Medium
Spring Security Static Resource Unauthorized Access Vulnerability (CVE-2024-38821)
Spring Security
- Affected products
- Affected version
- 5.x (spring-security 5.7.12)
- Status
- Fixed
- Published
- 2026-01-16
- Discovered
- 2024-10-27
CVE-2024-22243Medium
Spring Web UriComponentsBuilder URL Parsing Improper Vulnerability (CVE-2024-22243)
Spring Web
- Affected products
- Affected version
- 5.x (spring-web 5.3.33)
- Status
- Fixed
- Published
- 2026-01-16
- Discovered
- 2024-02-22
CVE-2024-38809Medium
Spring Framework ETags Parsing Denial of Service Vulnerability (CVE-2024-38809)
Spring Framework
- Affected products
- Affected version
- 5.x (spring-core 5.2.6)
- Status
- Fixed
- Published
- 2026-01-16
- Discovered
- 2024-09-26
| ID | Name | Family | Severity ↓ | Affected Products | Affected Version | Status | Discovered | Published ↕ |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-22731 | Spring Boot Actuator | fastjson | High | DOOPTSB | — | Fixed | 2026-03-18 | 2026-06-01 |
| CVE-2026-22733 | Authentication Bypass under Actuator CloudFoundry endpoints | Spring Security | High | TSB | — | Fixed | 2026-03-18 | 2026-06-01 |
| CVE-2022-25845 | Deserialization of Untrusted Data | fastjson | High | DOOP | — | Fixed | 2022-06-09 | 2026-07-30 |
| CVE-2025-27818 | Apache Kafka Client LdapLoginModule Configuration Code Execution Vulnerability (CVE-2025-27818) | Apache Kafka | High | DOUC | 5.x (kafka-clients 3.8.0) | Fixed | 2025-06-08 | 2026-01-16 |
| CVE-2025-27817 | Apache Kafka Client Arbitrary File Read and SSRF Vulnerability (CVE-2025-27817) | Apache Kafka | High | DOUC | 5.x (kafka-clients 3.8.0) | Fixed | 2025-06-09 | 2026-01-16 |
| CVE-2024-38816 | Spring Framework Conditional Directory Traversal Vulnerability (CVE-2024-38816) | Spring Framework | High | Common Components | 5.x (spring 5.3.39, Nacos) | Fixed | 2024-09-12 | 2026-01-16 |
| CVE-2024-38819 | Spring Framework Conditional Directory Traversal Vulnerability (CVE-2024-38819) | Spring Framework | High | Common Components | 5.x (spring 5.3.39, Nacos) | Fixed | 2024-12-18 | 2026-01-16 |
| CVE-2024-38821 | Spring Security Static Resource Unauthorized Access Vulnerability (CVE-2024-38821) | Spring Security | Medium | CMDBDOCCDOUCITSM | 5.x (spring-security 5.7.12) | Fixed | 2024-10-27 | 2026-01-16 |
| CVE-2024-22243 | Spring Web UriComponentsBuilder URL Parsing Improper Vulnerability (CVE-2024-22243) | Spring Web | Medium | DOCC | 5.x (spring-web 5.3.33) | Fixed | 2024-02-22 | 2026-01-16 |
| CVE-2024-38809 | Spring Framework ETags Parsing Denial of Service Vulnerability (CVE-2024-38809) | Spring Framework | Medium | ITSM | 5.x (spring-core 5.2.6) | Fixed | 2024-09-26 | 2026-01-16 |
1–10 of 10
1–10 of 10