de.is24.common:switchman (>=1.0, <=1.3), io.fabric8.jube.images.fabric8:springboot-webmvc (>=2.0.20, <=2.0.37) +2 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.2.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - de.is24.common:switchman =1.0, =2.0.20, =1.2.0.release,...

com.github.zengfr.project:com.github.zengfr.project.common (0.0.1), com.github.zengfr.project:com.github.zengfr.project.pom (0.0.1) +9 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.3.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.zengfr.project:com.github.zengfr.project.common...

Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

io.springfox:springfox-data-rest (>=2.6.0, <=2.6.1), org.appverse.web.framework.modules.backend.frontfacade.mvc.schema:appverse-web-modules-backend-frontfacade-mvc-schema (2.0.0-rc10) +4 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.4.4.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.springfox:springfox-data-rest =2.6.0, =1.3.3.release,...

be.personify.iam:personify-api (>=1.5.3.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release) +29 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (>=4.4.0, <=4.4.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.4.0, =1.5.3.release, =1.5.4.release, =1.5.4.release, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.11.1, =0.11.1, =0.11.1, =0.11.1, =3.0.16, =3.0.16, =3.0.17 and more Source cves: CVE-2026-41730 Source advisory: OSV:GHSA-P...

com.groupbyinc:common-spring-boot (>=79, <=92), com.heapbrain:heapaudit (1.0.0) +6 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.groupbyinc:common-spring-boot =79, =1.0.1, =1.0.1,...

org.springframework.data:spring-data-rest-webmvc (2.1.6.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.1.6.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

be.personify.iam:personify-api (>=1.5.3.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release) +29 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=4.4.0, <=4.4.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.4.0, =1.5.3.release, =1.5.4.release, =1.5.4.release, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.11.1, =0.11.1, =0.11.1, =0.11.1, =3.0.16, =3.0.16, =3.0.17 and more Source cves: CVE-2026-41837 Source advisory: GHSA-MWPV-...

com.ixortalk:ixortalk-authorization-server (>=0.0.1, <=0.0.6), org.springframework.boot:spring-boot-starter-data-rest (1.5.21.release) +2 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.22.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.ixortalk:ixortalk-authorization-server =0.0.1, =0.0.6 ...

com.github.paulcwarren:spring-content-rest (0.0.5), com.github.paulcwarren:spring-content-rest-boot-starter (0.0.5) +6 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.4.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.paulcwarren:spring-content-rest 0.0.5 -...

org.springframework.data:spring-data-rest-webmvc (2.0.3.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.0.3.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

org.springframework.boot:spring-boot-starter-data-rest (1.3.8.release), org.springframework.data:spring-data-rest-hal-browser (2.4.5.release) +1 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.4.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.springframework.boot:spring-boot-starter-data-rest (>=1.5.11.release, <=1.5.12.release), org.springframework.data:spring-data-rest-hal-browser (2.6.11.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.11.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

GHSA-J388-8RM5-P97F Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

com.github.codinghck:utils (1.1.1-release), com.twosigma.webtau:webtau-docs (>=1.16, <=1.20) +17 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.7.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.codinghck:utils 1.1.1-release -...

org.springframework.data:spring-data-rest-hal-browser (2.5.0.release), org.springframework.data:spring-data-rest-webmvc (2.5.0.release) potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.5.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

GHSA-CV39-X4C6-HHP2 Spring Data REST has Improper Access Control in its JSON Patch Implementation

Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...

Spring Data REST potentially exposes persistence-layer internals to HTTP clients

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

GHSA-6RPQ-6VV2-5222 Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

io.github.divinespear:jpa-schema-gradle-plugin (>=0.1.7-1, <=0.1.10), io.github.jhipster.loaded:agent (>=0.2, <=0.12) +15 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.7.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - io.github.divinespear:jpa-schema-gradle-plugin =0.1.7-1, =0.2,...