CLEANSTART-2026-TC92971 Security fix for CVE-2026-41850 applied in: activemq 5.19.8-r3, apache-hive 4.1.0-r5, apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3, rundeck 6.0.0-r0

CVE-2026-41850 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-41850

CVE-2026-41850...

CVE-2026-41850 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, zipkin, apache-nifi-registry...

Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-expression jar

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-41850, CVE-2026-41851 and CVE-2026-41852 reported for spring-expression-6.2.12.jar, spring-expression-6.2.18.jar . Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary spring-expression-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...

CVE-2026-41850

creationtimestamp| type| source ---|---|--- 2026-06-09 07:01:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mntmt63scm2i...

ch.codeblock.qrinvoice.rest:qrinvoice-rest-standalone (>=0.7, <=0.8), ch.rasc:sse-eventbus (1.1.6) +1654 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.14.release)

org.springframework:spring-expression MAVEN version 4.3.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.codeblock.qrinvoice.rest:qrinvoice-rest-standalone =0.7, =0.1.6-v1, =1.0....

cn.wizzer.app:wk-common (>=5.1.5, <=5.2.8-zookeeper), cn.wizzer.app:wk-nb-service-cms (>=5.1.5, <=5.2.8-zookeeper) +347 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.21.release)

org.springframework:spring-expression MAVEN version 4.3.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.wizzer.app:wk-common =5.1.5, =5.1.5, =5.1.5, =5.1.5, =5.1.5, =5.1.5,...

com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate (>=2.3.12, <=2.3.20), com.github.fangjinuo.audit:audit-spring (>=2.3.12, <=2.3.20) +129 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.29.release)

org.springframework:spring-expression MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate...

am.ik.blog:blog-domain (>=4.0.2, <=4.2.0), am.ik.blog:blog-mapper (>=4.0.0, <=4.4.0) +1708 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.7.release)

org.springframework:spring-expression MAVEN version 4.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - am.ik.blog:blog-domain =4.0.2, =4.0.0, =2.0.0, =1.0.3, =1.0.0, =2.4, =2.4,...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +831 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.5.release)

org.springframework:spring-expression MAVEN version 4.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =0.0.25, =1.3.1, =0.0.25,...

ar.com.fdvs:dynamicjasper (>=5.0.9, <=5.1.0), br.com.caelum.stella:caelum-stella-boleto (>=2.1.7, <=2.2.2) +842 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (3.0.6.release)

org.springframework:spring-expression MAVEN version 3.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ar.com.fdvs:dynamicjasper =5.0.9, =2.1.7, =20.3.0, =20.3.0, =2.23.5, =2.23.5,...

br.com.anteros:anteros-spring-swagger (1.0.0), club.javafamily:javafamily-rest (>=0.1.0.release, <=0.1.1.release) +379 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.0.9.release)

org.springframework:spring-expression MAVEN version 4.0.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.com.anteros:anteros-spring-swagger 1.0.0 - club.javafamily:javafamily-rest...

br.ufc.quixada.npi:npi-core-api (0.1.0), ch.ralscha:extdirectspring (1.5.1) +539 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.1.4.release)

org.springframework:spring-expression MAVEN version 4.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.ufc.quixada.npi:npi-core-api 0.1.0 - ch.ralscha:extdirectspring 1.5.1 -...

com.geodevv.testing:irmina (>=1.0.0, <=1.0.2), com.github.dblock.waffle:waffle-spring-security3 (1.7.3) +105 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (3.2.12.release)

org.springframework:spring-expression MAVEN version 3.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.geodevv.testing:irmina =1.0.0, =2.5.0, =1.2.3, =1.4.19 and more Source...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +348 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.1.release)

org.springframework:spring-expression MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release,...

ch.ralscha:extdirectspring (1.5.0), cn.enilu:flash-core (1.0) +136 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.1.2.release)

org.springframework:spring-expression MAVEN version 4.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.ralscha:extdirectspring 1.5.0 - cn.enilu:flash-core 1.0 -...

be.rufer.swisscom.sms:api-client (1.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (0.9) +233 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.1.3.release)

org.springframework:spring-expression MAVEN version 4.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - be.rufer.swisscom.sms:api-client 1.0 -...

com.github.dalet-oss:mongobee (>=1.0.1, <=1.0.4), com.github.mjeanroy:springmvc-mustache (>=0.6.0, <=1.0.0) +146 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.27.release)

org.springframework:spring-expression MAVEN version 4.3.27.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.dalet-oss:mongobee =1.0.1, =0.6.0, =0.10.0, =0.10.0, =0.10.0,...

au.com.mountain-pass:hyperstate-cert (>=1, <=10), au.com.mountain-pass:hyperstate-client (>=1, <=10) +1188 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.2.release)

org.springframework:spring-expression MAVEN version 4.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - au.com.mountain-pass:hyperstate-cert =1, =1, =1, =1, =1, =1, =0.1, =1.0.0-rc,...