[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMpEi2dUtmcNeAsbBZxAIQ59M3uPj3ck4GgM3ln8KYlU":3},{"article":4,"iocs":56,"watch_terms":67,"solutions":68,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"80e0ea44-c621-4cd5-807f-5173d67e93a9","91 Vulnerabilities Patched in Spring Application Framework","91-vulnerabilities-patched-in-spring-application-framework-6dfa71","More than 200 vulnerabilities have been patched to date this year, compared to only 16 in 2025 and 22 in 2024. The post 91 Vulnerabilities Patched in Spring Application Framework appeared first on SecurityWeek.","Broadcom's Spring application development framework has released updates addressing 91 vulnerabilities, with one critical flaw (CVE-2026-59270) affecting its embedded LDAP server. Over a dozen high-severity vulnerabilities are also included, enabling attacks like XSS, RCE, and DoS. The surge in vulnerabilities is attributed to Broadcom's increased use of AI in development, with over 200 vulnerabilities patched this year alone, a significant increase from previous years.","Spring application framework releases updates patching 91 vulnerabilities, including one critical.","https:\u002F\u002Fwww.securityweek.com\u002F91-vulnerabilities-patched-in-spring-application-framework\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F12\u002FCode-3rd-Party-Risk.jpg","2026-08-24T11:58:28+00:00","2026-08-24T12:00:09.5658+00:00",8,[17,20,23,25,27,30],{"name":18,"type":19},"Broadcom","vendor",{"name":21,"type":22},"Spring Application Framework","product",{"name":24,"type":22},"Spring Security",{"name":26,"type":22},"Spring AI",{"name":28,"type":29},"LDAP","technology",{"name":31,"type":32},"Spring4Shell","campaign","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,41,46,51],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61,64],{"type":58,"value":59,"context":60},"cve","CVE-2026-59270","Critical severity vulnerability in Spring Security's embedded UnboundID LDAP server.",{"type":58,"value":62,"context":63},"CVE-2026-59285","Critical remote code execution issue in Spring for GraphQL.",{"type":58,"value":65,"context":66},"CVE-2026-59318","Medium-severity issue in Spring AI's tool-calling functionality allowing privilege escalation.",[18,21,24],{"controls":69,"vendors":151},[70,99,124],{"slug":71,"name":72,"problem":73,"products":74},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":100,"name":101,"problem":102,"products":103},"patch-management","Automated patch management","Known holes get closed in days, not months.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":100,"product_name":121,"url":122,"description":123},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":125,"name":126,"problem":127,"products":128},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[129,137,143],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":138,"product_name":139,"url":141,"description":142},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[152],{"slug":153,"name":154,"logo_path":155,"roles":156},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png",[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":171},"91-flaws-patched-in-spring-framework-amid-ai-driven-development-surge","91 Flaws Patched in Spring Framework Amid AI-Driven Development Surge","Broadcom's Spring framework released patches for 91 vulnerabilities, including a critical LDAP flaw (CVE-2026-59270) and over a dozen high-severity issues enabling RCE, XSS, and DoS attacks. The dramatic spike in vulnerabilities — over 200 patched this year alone — is directly linked to Broadcom's increased reliance on AI-assisted code generation, which can introduce subtle security flaws at scale if not rigorously reviewed. This highlights a growing risk: AI accelerates development speed but can also accelerate the introduction of security defects if secure-by-design principles and thorough code review are not embedded in the development lifecycle. Organizations relying on Spring-based applications must treat this patch cycle as urgent, since unpatched RCE and LDAP vulnerabilities in widely-used frameworks are prime targets for exploitation.",[163,164,165,166,167,168,169,170],"CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SA-11: Developer Testing and Evaluation","NIST SP 800-218 SSDF: Secure Software Development Framework","OWASP Top 10: A06 Vulnerable and Outdated Components","ISO\u002FIEC 27001: A.12.6 Management of Technical Vulnerabilities","GDPR Article 32: Security of Processing (patch management as technical measure)",{}]