CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-47877

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 8.5%

CVSS Severity

CVSS v3 Score 8.2

References

https://spring.io/security/cve-2026-47877

Products affected by CVE-2026-47877

Vmware » Spring Security » Version: 7.0.0

cpe:2.3:a:vmware:spring_security:7.0.0
Vmware » Spring Security » Version: 7.0.1

cpe:2.3:a:vmware:spring_security:7.0.1
Vmware » Spring Security » Version: 7.0.2

cpe:2.3:a:vmware:spring_security:7.0.2
Vmware » Spring Security » Version: 7.0.3

cpe:2.3:a:vmware:spring_security:7.0.3
Vmware » Spring Security » Version: 7.0.4

cpe:2.3:a:vmware:spring_security:7.0.4
Vmware » Spring Security » Version: 7.0.5

cpe:2.3:a:vmware:spring_security:7.0.5
Vmware » Spring Security » Version: 7.0.5.1

cpe:2.3:a:vmware:spring_security:7.0.5.1
Vmware » Spring Security » Version: 7.0.6

cpe:2.3:a:vmware:spring_security:7.0.6
Vmware » Spring Security » Version: 7.1.0

cpe:2.3:a:vmware:spring_security:7.1.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-47877

Products

Pricing

Contact Us