CVE-2026-40986 — Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if th — CVE Database · The Intelligence Room