EUVD-2026-35901

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

cn.net.vidyo:jsmth-data (3.3.120.release), com.github.vencent-lu:giants-cache-redis (>=1.0.4, <=1.0.5-beta-7) +4 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.4.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.net.vidyo:jsmth-data 3.3.120.release -...

GHSA-XG2J-3HJ6-PC24 Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

com.github.jknack:mwa-mongo (>=0.4.1, <=0.4.2), com.github.jknack:mwa-morphia (>=0.4.1, <=0.4.2) +7 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.3.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.jknack:mwa-mongo =0.4.1, =0.4.1, =4.1.0, =3.0.6,...

io.rhiot:rhiot-cloudlet-geofencing (0.1.1), io.rhiot:rhiot-iot-cloudlet-document-default (0.1.1) +4 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.6.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.6.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - io.rhiot:rhiot-cloudlet-geofencing 0.1.1 -...

com.kurento.kmf:kmf-content-api (>=3.0.5, <=4.3.1), com.kurento.kmf:kmf-repository-api (4.3.1) +4 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.5.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.5.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.kurento.kmf:kmf-content-api =3.0.5, =5.0.3, =1.0.3.release,...

GHSA-HC43-M36C-8V33 Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

com.github.edgarespina:mwa-mongo (>=0.2.5, <=0.2.7), com.github.edgarespina:mwa-morphia (>=0.2.5, <=0.2.7) +18 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.0.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.edgarespina:mwa-mongo =0.2.5, =0.2.5, =0.3.0, =0.3.0...

com.github.jknack:mwa-mongo (>=0.4.1, <=0.4.2), com.github.jknack:mwa-morphia (>=0.4.1, <=0.4.2) +7 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.3.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.jknack:mwa-mongo =0.4.1, =0.4.1, =4.1.0, =3.0.6,...

co.aurasphere.botmill:botmill-core (>=1.0.0, <=1.0.2), co.aurasphere.botmill:fb-botmill (>=2.0.0-rc1, <=2.0.0-rc3) +30 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.5.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - co.aurasphere.botmill:botmill-core =1.0.0, =2.0.0-rc1, =1.1,...

CVE-2026-41719

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

CVE-2026-40993

An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository saml2assertingpartymetadata may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials verificationcredentials and...

PT-2026-48537

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.22.0 Description vLLM is an inference and serving engine for large language models. The software contains a supply-chain integrity issue where revision pinning controls are not consistently applied to all artifacts...

PT-2026-48538

Name of the Vulnerable Software and Affected Versions anyquery versions prior to 0.4.5 Description A path traversal issue exists in the SQL scalar function clear plugin cache within the namespace/other functions.go file. The function accepts a plugin argument and passes it to path.Join and...

CVE-2026-41719: Improper Neutralization of Special Elements used in an Expression Language Statement

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

CVE-2026-41719 Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

CVE-2026-41719

Technical details about CVE-2026-41719 are not publicly available in the provided documents. Monitor for updates from official advisories; no specifics on affected products, vectors, or fixes are provided here.

EUVD-2026-35707

Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in...

CVE-2026-49959

Hermes WebUI prior to 0.51.311 is affected by a remote code execution vulnerability. Authenticated attackers can trigger arbitrary commands by placing a malicious executable Git configuration in a workspace repo’s .git/config. The issue arises from Git subprocess invocations in api/workspace_git....

CVE-2026-49959 Hermes WebUI < 0.51.311 RCE via Git Configuration Injection

Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in...