Sploitus

17 exploited vulnerabilities in Spring Boot

Vulnerabilities with publicly known exploits

Vendors
Apache, Vmware, Unknown, Spring, Broadcom, Alibaba
With known exploits
17
Affected Vmware Spring Boot versions
< 2.7.33, 3.3.19, 3.4.16, 3.5.14, 4.0.6, 2.5.15, 2.6.14, 2.7.11, 3.0.6, 1.5.9, 2.0.0, 2.7.32, 3.3.18, 3.4.15, 3.5.12, 4.0.4, 2.6.0, 2.5.14, 2.7.17, 3.0.12, 3.1.5
Affected Apache Shiro versions
< 1.11.0

Vulnerabilities with exploits

Highest CVSS first — 2 of these already have exploit code on Sploitus

CVE-2026-40974
CVSS 9.8 CRITICAL 2026-04-27FIX AVAILABLE
CVE-2023-20873
CVSS 9.8 CRITICAL 2023-04-20FIX AVAILABLE
CVE-2017-8046 8 exploits
CVSS 9.8 CRITICAL 2018-01-04FIX AVAILABLE
Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution ExSpring Data REST 2.6.9 (Ingalls SR9) 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution
CVE-2026-40976
CVSS 9.1 CRITICAL 2026-04-27FIX AVAILABLE
CVE-2026-40971
CVSS 9.1 CRITICAL 2026-04-27FIX AVAILABLE
CVE-2026-16723 3 exploits
CVSS 9.0 CRITICAL 2026-07-21FIX AVAILABLE
Exploit for CVE-2026-16723Exploit for CVE-2026-16723
CVE-2026-40975
CVSS 8.2 HIGH 2026-04-27FIX AVAILABLE
CVE-2026-22733
CVSS 8.2 HIGH 2026-03-19FIX AVAILABLE
CVE-2026-22731
CVSS 8.2 HIGH 2026-03-19FIX AVAILABLE
CVE-2023-22602
CVSS 7.8 HIGH 2023-01-13FIX AVAILABLE
CVE-2022-27772
CVSS 7.8 HIGH 2022-03-30FIX AVAILABLE
CVE-2026-40972
CVSS 7.5 HIGH 2026-04-27FIX AVAILABLE
CVE-2023-20883
CVSS 7.5 HIGH 2023-05-19FIX AVAILABLE
CVE-2026-40973
CVSS 7.0 HIGH 2026-04-27FIX AVAILABLE
CVE-2026-40970
CVSS 6.8 MEDIUM 2026-04-27FIX AVAILABLE
CVE-2023-34055
CVSS 6.8 MEDIUM 2023-11-28FIX AVAILABLE
CVE-2026-40977
CVSS 6.7 MEDIUM 2026-04-27FIX AVAILABLE