References https://www.xtcaq.com/nd.jsp?id=8792 https://avd.aliyun.com/detail?id=AVD-2026-22732 https://spring.io/security/cve-2026-22732 https://cve.imfht.com/detail/CVE-2026-22732 https://zone.ci/vulns/ys/339173.html https://nvd.nist.gov/vuln/detail/CVE-2026-22732 https://stack.chaitin.com/vuldb/detail/0f84e68d-964b-4357-bc6d-decd17493128 https://knowledge.broadcom.com/external/article/438182/workaround-for-cve202622732-in-spring-bo.html https://www.herodevs.com/blog-posts/cve-2026-22732-spring-security-silently-drops-http-security-headers https://nflo.tech/knowledge-base/2026-03-20-cve-2026-22732-en/
Related VulnerabilitiesPoCCVE-2026-0561: Shield Security <= 21.0.8 - Unauthenticated Reflected XSSPoCCVE-2026-5032: W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token DisclosureVMware ESXi /sdk 默认口令漏洞SpringBlade /api/blade-log/api/list SQL 注入漏洞SpringBlade /api/blade-user/list SQL 注入漏洞Spring Actuator 未授权访问漏洞Tattile Camera /api/v1/security/login 默认口令漏洞(CVE-2026-26341)PoCspringboot-sbom: Spring Boot Actuator SBOM - ExposurePoCCVE-2023-49438: Python Flask-Security-Too <=5.3.2 - Open RedirectPoCCVE-2025-41242: Spring Framework - Path TraversalPoCspringboot-httpexchanges: Detects Springboot HTTP Exchanges ActuatorPoCCVE-2024-38819: Spring Framework Path Traversal in Functional Web FrameworksRundeck /j_security_check 默认口令漏洞