CVE-2026-47849 Spring Data REST allows mutation of identifier and version properties via JSON Patch

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

CVE-2026-47849

Spring Data REST fails to protect @Id and @Version properties from mutation via RFC 6902 JSON Patch requests (content type application/json-patch+json). This allows an authenticated user to alter identifier and version fields, leading to high integrity impact (CVSS 3.1: 7.1, AV:N/AC:L/PR:L/UI:N/S...

EUVD-2026-66837

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

EUVD-2026-66820

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-47850

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

PT-2026-82693

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

CVE-2026-66155: Improper Neutralization of Input During Web Page Generation

A vulnerability has been identified in Element maps-ng V47 All versions V47.12.3, Element maps-ng V48 All versions V48.11.3, Element maps-ng V49 All versions V49.16.1. The si-map component does not properly neutralize user-controllable input of the points property that is used to render the toolt...

CVE-2026-59282: Uncontrolled Resource Consumption

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

PT-2026-82393

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

CVE-2026-47850: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

PT-2026-82485

A vulnerability has been identified in Element maps-ng V47 All versions V47.12.3, Element maps-ng V48 All versions V48.11.3, Element maps-ng V49 All versions V49.16.1. The si-map component does not properly neutralize user-controllable input of the points property that is used to render the toolt...

PT-2026-82695

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier...

CVE-2026-47850 Spring Data REST allows mutation of the version property of immutable aggregates via PUT

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-47850

Spring Data REST does not preserve the persisted @Version property of an aggregate root when handling an HTTP PUT against an immutable target type, allowing mutation of the version field. The issue is rated MEDIUM (CVSS 4.3) with a low integrity impact. Affected versions include 5.1.0 , 5.0.0–5.0...

CVE-2026-47850 Spring Data REST allows mutation of the version property of immutable aggregates via PUT

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

CVE-2026-75340

The device metadata import interface /device/instance/productId/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery SSRF...

SUSE CVE-2026-68461

In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnodehandle in fwnodeinit If a firmware node is allocated on the stack for instance: temporary software node whose life-time we control or on the heap - but using a non-zeroing...

SUSE CVE-2026-74271

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix suppliedfrom allocations If dts property power-supplies has multiple values, then accessing to psy-suppliedfromi-1 in powersupplypopulatesuppliedfrom will overrun suppliedfrom array...

Controlling when CSS custom property values are computed

When and how CSS custom property values are calculated might not be what you expect, and it has a big impact on your styles. The default Take this HTML: … And this CSS: .second-item --index: sibling-index; & :first-child scale: var--index; If you're unfamiliar with sibling-index, here's a quick...

PT-2026-82339

Name of the Vulnerable Software and Affected Versions jetlinks community version 2.11 Description The device metadata import interface '/device/instance/productId/property-metadata/import' is susceptible to Server-side request forgery SSRF, a flaw that allows an attacker to induce the server-side...