EUVD-2026-36214

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

CVE-2026-41856

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

PT-2026-48627

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 1.0.0 through 1.0.6 Spring for GraphQL versions 1.3.0 through 1.3.8 Spring for GraphQL versions 1.4.0 through 1.4.5 Spring for GraphQL versions 2.0.0 through 2.0.3 Description The annotation detection mechanism for...

CVE-2026-41856: Improper Access Control

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

PT-2026-80298

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

org.cometd.java:cometd-java-annotation-server (>=6.0.0, <=6.0.18), org.cometd.java:cometd-java-benchmark-server (>=6.0.0, <=6.0.18) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=6.0.0, <=6.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.18 Source cves: CVE-2025-53114 Source advisory: GHSA-CQGJ-H8VF-4W59...

org.cometd.java:cometd-java-annotation-server (>=5.0.0, <=5.0.22), org.cometd.java:cometd-java-benchmark-server (>=5.0.0, <=5.0.22) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=5.0.0, <=5.0.22)

org.cometd.java:cometd-java-server-common MAVEN version =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.2, =5.0.22 Source cves: CVE-2025-53114 Source advisory: GHSA-CQGJ-H8VF-4W59...

org.cometd.java:cometd-java-annotation-server (>=6.0.0, <=6.0.18), org.cometd.java:cometd-java-benchmark-server (>=6.0.0, <=6.0.18) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=6.0.0, <=6.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.18 Source cves: CVE-2025-53114 Source advisory: SNYK:JAVA-ORGCOMETDJAVA-17729650...

org.apache.camel.karaf:camel-cometd (>=4.7.0, <=4.10.7), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.13.0, <=3.25.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=8.0.0, <=8.0.8)

org.cometd.java:cometd-java-server-common MAVEN version =8.0.0, =4.7.0, =3.13.0, =3.13.0, =4.7.0, =4.7.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.8 Source cves: CVE-2025-53114 Source advisory: OSV:GHSA-CQGJ-H8VF-4W59...

org.cometd.java:cometd-java-annotation-server (>=6.0.0, <=6.0.18), org.cometd.java:cometd-java-benchmark-server (>=6.0.0, <=6.0.18) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=6.0.0, <=6.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.18 Source cves: CVE-2025-53114 Source advisory: OSV:GHSA-CQGJ-H8VF-4W59...

org.apache.camel.karaf:camel-cometd (>=4.7.0, <=4.10.7), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.13.0, <=3.25.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=8.0.0, <=8.0.8)

org.cometd.java:cometd-java-server-common MAVEN version =8.0.0, =4.7.0, =3.13.0, =3.13.0, =4.7.0, =4.7.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.8 Source cves: CVE-2025-53114 Source advisory: SNYK:JAVA-ORGCOMETDJAVA-17729650...

org.apache.camel.karaf:camel-cometd (>=4.7.0, <=4.10.7), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.13.0, <=3.25.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=8.0.0, <=8.0.8)

org.cometd.java:cometd-java-server-common MAVEN version =8.0.0, =4.7.0, =3.13.0, =3.13.0, =4.7.0, =4.7.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.8 Source cves: CVE-2025-53114 Source advisory: GHSA-CQGJ-H8VF-4W59...

org.cometd.java:cometd-java-annotation-server (>=5.0.0, <=5.0.22), org.cometd.java:cometd-java-benchmark-server (>=5.0.0, <=5.0.22) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=5.0.0, <=5.0.22)

org.cometd.java:cometd-java-server-common MAVEN version =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.2, =5.0.22 Source cves: CVE-2025-53114 Source advisory: SNYK:JAVA-ORGCOMETDJAVA-17729650...

CVE-2026-52750 Ghidra < 12.1- Command Injection via URL Annotation Click

Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arbitrary commands under the Ghidra user's privileges by embedding malicious URLs in program comments that victims click...

CVE-2026-52750 Ghidra < 12.1- Command Injection via URL Annotation Click

Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arbitrary commands under the Ghidra user's privileges by embedding malicious URLs in program comments that victims click...

CVE-2026-52750

Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arbitrary commands under the Ghidra user's privileges by embedding malicious URLs in program comments that victims click...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +172 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

GHSA-HC43-M36C-8V33 Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

EUVD-2026-35900

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...