Spring Data Commons
Vendor:
First CVE: Apr 11, 2018 · Active for 8 years
7
Total CVEs
More Total CVEs than 83% of tracked products
3.5
Avg CVEs / Year
Higher CVE frequency than 82% of tracked products
7.4
Avg CVSS
Higher Avg CVSS than 48% of tracked products
14.3%
KEV Rate
Higher KEV Rate than 98% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Spring Data Commons over time
Volume of CVEsAvg CVSS Base Score
First CVE
Apr 11, 2018
8 years ago
Most Recent CVE
Jun 10, 2026
44 days ago
CVE Severity & Scoring
Spring Data Commons7 CVEs
29%
57%
14%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network7 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low5 (71.4%)
High2 (28.6%)
Unknown0 (0.0%)
User Interaction
None7 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None7 (100.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-1273CRITICAL Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of s | Apr 11, 2018 | 9.8 | 98 | YES | YES |
CVE-2026-41716HIGH Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.
Affected | Jun 10, 2026 | 7.5 | 32 | NO | NO |
CVE-2026-41695HIGH Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext prop | Jun 10, 2026 | 7.5 | 32 | NO | NO |
CVE-2018-1259HIGH Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability ca | May 11, 2018 | 7.5 | 28 | NO | NO |
CVE-2018-1274HIGH Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. A | Apr 18, 2018 | 7.5 | 27 | NO | NO |
CVE-2026-41721MEDIUM Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method usin | Jun 10, 2026 | 5.9 | 26 | NO | NO |
CVE-2026-41711MEDIUM Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.
Affected versions:
S | Jun 10, 2026 | 5.9 | 26 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
1 CVE
14.3% of CVEs· 98th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
14.3% of CVEs· 97th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Spring Data Commons
Top CWEs
Versions
No cataloged versions.