com.github.aidensuen:mongodao-core (>=1.0.1, <=1.1.2), com.github.aidensuen:mongodao-pagehelper (>=1.0.3, <=1.1.2) +30 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.aidensuen:mongodao-core =1.0.1, =1.0.3, =1.0.3,...

com.github.lodsve:lodsve-amqp (>=2.5.8, <=2.5.9), org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.0.2, <=5.0.10) +3 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.6.4.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.github.lodsve:lodsve-amqp =2.5.8, =5.0.2, =5.0.10 -...

com.ahome-it:ahome-tooling-server-core (1.1.0-release), com.ahome-it:ahome-tooling-server-hazelcast (1.1.0-release) +151 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.5.6.release)

org.springframework.amqp:spring-amqp MAVEN version 1.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.ahome-it:ahome-tooling-server-core 1.1.0-release -...

org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.1.0-rc4, <=5.1.9), org.springframework.amqp:spring-rabbit (1.6.8.release) +3 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.6.8.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.apereo.cas:cas-server-core-configuration-cloud-amqp =5.1.0-rc4,...

org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.2.0-rc1, <=5.2.0-rc3), org.springframework.amqp:spring-rabbit (1.6.10.release) +3 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.6.10.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.apereo.cas:cas-server-core-configuration-cloud-amqp =5.2.0-rc1,...

CVE-2026-46491

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths for the file-based CAS ticket store by directly concatenating the configured ticket directory with an attacker-controll...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-41000 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-41000 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320735...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40997 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320569...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40995 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40995 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320712...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40994 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320710...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40996 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40996 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320523...

com.github.inspektr:inspektr-support-spring (1.0.0.ga), org.jasig.cas3.extensions:clearpass-impl (>=1.0.1.ga, <=1.0.5.ga) +25 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (3.0.1.release)

org.springframework:spring-webmvc MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.inspektr:inspektr-support-spring 1.0.0.ga -...

com.github.inspektr:inspektr-support-spring (1.0.0.ga), fr.figarocms:web-debug-tag (>=0.0.1, <=1.0) +57 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (3.0.1.release)

org.springframework:spring-expression MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.inspektr:inspektr-support-spring 1.0.0.ga -...

io.vilt.minium.developer:minium-developer-bundle (>=1.9.5, <=2.6.0), io.vilt.minium.developer:minium-developer-fs (>=1.9.5, <=2.6.0) +32 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.19.release)

org.springframework:spring-websocket MAVEN version 4.3.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - io.vilt.minium.developer:minium-developer-bundle =1.9.5, =1.9.5, =1.9.5,...

com.github.inspektr:inspektr-support-spring (1.0.0.ga), org.jasig.cas3.extensions:clearpass-impl (>=1.0.1.ga, <=1.0.5.ga) +25 more potentially affected by CVE-2026-41845 via org.springframework:spring-webmvc (3.0.1.release)

org.springframework:spring-webmvc MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.inspektr:inspektr-support-spring 1.0.0.ga -...

Path Traversal

SimpleSAMLphp-casserver is vulnerable to Path Traversal. The vulnerability is due to improper validation of user-controlled ticket identifiers when constructing file paths, where path traversal sequences can access and deserialize arbitrary files outside the ticket directory, allowing attackers t...

SimpleSAMLphp casserver: Open Redirect in logout

Summary The logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either depending on configuration redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url. There are a number of other things broke...

PT-2026-41385

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp-casserver versions prior to 6.3.1 SimpleSAMLphp-casserver versions prior to 7.0.0 Description The logout endpoint accepts a url query parameter for redirection. The server treats this URL as trusted and, depending on the...

io.mosip.kernel:kernel-config-server (>=1.2.1-rc1, <=1.3.1), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=7.0.0, <=7.1.6.2) +5 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=4.1.0, <=4.1.7)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.1.0, =1.2.1-rc1, =7.0.0, =7.0.0, =4.1.0, =3.1.0, =3.1.6 Source cves: CVE-2026-40982 Source advisory: GHSA-6G23-24MC-HX6X...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +6 more potentially affected by CVE-2026-41004 via org.springframework.cloud:spring-cloud-config-server (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.2.0, =0.0.1, =1.0.0, =3.0.9, =0.1.41-beta, =7.2.0-rc3, =7.2.0-rc3, =4.2.0, =3.2.0, =3.2.3 Source cves: CVE-2026-41004 Source advisory: GHSA-J6HH-H3CF-C2HF...