com.github.paulcwarren:spring-content-rest (0.0.5), com.github.paulcwarren:spring-content-rest-boot-starter (0.0.5) +6 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.4.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.paulcwarren:spring-content-rest 0.0.5 -...

org.springframework.boot:spring-boot-starter-data-rest (>=1.0.0.release, <=1.0.1.release), org.springframework.data:spring-data-rest-webmvc (2.0.1.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.0.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.github.paulcwarren:spring-content-rest (>=0.0.1, <=0.0.2), com.github.paulcwarren:spring-content-rest-boot-starter (>=0.0.1, <=0.0.2) +4 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.5.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.paulcwarren:spring-content-rest =0.0.1, =0.0.1,...

com.lordofthejars:nosqlunit-mongodb (>=0.9.0, <=1.0.0), org.grails:grails-datastore-gorm-mongodb (>=3.0.2.release, <=3.1.5.release) +9 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.7.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.9.0, =3.0.2.release,...

org.springframework.boot:spring-boot-starter-data-rest (1.1.4.release), org.springframework.data:spring-data-rest-webmvc (2.1.1.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.1.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.jsondoc:jsondoc-springmvc (>=1.2.14, <=1.2.23), org.springframework.data:spring-data-rest-hal-browser (2.5.1.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.jsondoc:jsondoc-springmvc =1.2.14, =1.2.23 -...

org.springframework.data:spring-data-rest-hal-browser (2.5.4.release), org.springframework.data:spring-data-rest-webmvc (2.5.4.release) potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.5.4.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

org.springframework.boot:spring-boot-starter-data-elasticsearch (>=1.1.11.release, <=1.1.12.release), org.springframework.boot:spring-boot-starter-data-jpa (>=1.1.11.release, <=1.1.12.release) +22 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.8.5.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.boot:spring-boot-starter-data-elasticsearch...

io.github.divinespear:jpa-schema-gradle-plugin (>=0.1.7-1, <=0.1.10), io.github.jhipster.loaded:agent (>=0.2, <=0.12) +15 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.7.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - io.github.divinespear:jpa-schema-gradle-plugin =0.1.7-1, =0.2,...

org.springframework.data:spring-cql (1.0.6.release), org.springframework.data:spring-data-cassandra (1.0.6.release) +13 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.8.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.0.6.release -...

com.lordofthejars:nosqlunit-mongodb (>=0.9.0, <=1.0.0), org.grails:grails-datastore-gorm-mongodb (>=3.0.2.release, <=3.1.5.release) +9 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.7.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.9.0, =3.0.2.release,...

CVE-2026-41730

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

CVE-2026-41837

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

CVE-2026-41728

Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...

CVE-2026-41729

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

VMware Spring Data REST Access Control Vulnerability

VMware Spring Data REST is a data interface provided by the American company VMware. It is used to build domain models based on Spring Data repositories, and to expose hypermedia-driven HTTP resources for aggregates contained within those models. VMware Spring Data REST versions 3.7.0 and earlier...

VMware Spring Data REST security vulnerabilities

VMware Spring Data REST is a data interface provided by the American company VMware. It is used to build HTTP resources that drive hypermedia, based on Spring Data repositories. These resources are designed to manage domain models of applications and provide hypermedia-driven services for...

PT-2026-75991

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

VMware Spring Data REST security vulnerabilities

VMware Spring Data REST is a data interface provided by the American company VMware. It is used to build HTTP resources that drive hypermedia, based on Spring Data repositories. These resources are designed to manage domain models of applications and provide hypermedia-driven services for...

CVE-2026-41837: Improper Access Control

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...