Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Spring Web Flow 2.5.2, 3.0.1.1, 4.0.0.1 Clear all filters
TI-2026-29637 CVE-2026-40986 · GHSA-hw5c-xm3c-v96w

Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

Priority LOW 21

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response fro…

CVSS 3.1MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00206 Published 2026-06-11 Fixed in 4.0.0.1, 3.0.1.1 +3 CWE-79