com.github.hushengte:disciples-feed (1.0.5), com.github.paulcwarren:spring-content-rest (>=0.0.3, <=0.0.4) +4 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.3.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.hushengte:disciples-feed 1.0.5 -...

io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.cr2, <=1.1.0.cr3), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.cr2, <=1.1.0.cr5) +2 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.1.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.cr2,...

org.springframework.boot:spring-boot-starter-data-rest (1.5.19.release), org.springframework.data:spring-data-rest-hal-browser (2.6.18.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.18.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.springframework.data:spring-data-rest-hal-browser (2.6.21.release), org.springframework.data:spring-data-rest-webmvc (2.6.21.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.21.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

ai.apiverse:apipulse (1.0.1), app.commerce-io:spring-boot-starter-data-search-jpa (>=1.1.0-rc1, <=1.3.0) +385 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=3.0.0.release, <=3.7.18)

org.springframework.data:spring-data-rest-core MAVEN version =3.0.0.release, =1.1.0-rc1, =1.0.1.release, =1.0.0.release, =1.0.1.release, =1.1.8.release, =1.1.5.release, =1.0.0, =1.4.0, =1.6.0 - co.bittub.api:core 1.0.0 - com.9isuper.pelecanus:pelecanus-data-jpa 1.0.3.m1 -...

org.springframework.data:spring-data-rest-repository (1.0.0.release), org.springframework.data:spring-data-rest-webmvc (1.0.0.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (1.0.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-repository...

org.springframework.data:spring-data-rest-hal-browser (2.4.6.release), org.springframework.data:spring-data-rest-webmvc (2.4.6.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.4.6.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

io.springfox:springfox-data-rest (>=2.6.0, <=2.6.1), org.appverse.web.framework.modules.backend.frontfacade.mvc.schema:appverse-web-modules-backend-frontfacade-mvc-schema (2.0.0-rc10) +4 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.4.4.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.springfox:springfox-data-rest =2.6.0, =1.3.3.release,...

io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.beta6, <=1.1.0.cr1), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.beta6, <=1.1.0.cr1) +2 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.0.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.beta...

com.github.codefrogcc:allocation (>=1.0.0, <=1.1.4), com.github.codefrogcc:commons-config (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.13.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.codefrogcc:allocation =1.0.0, =1.0.0, =2.9.1,...

com.groupbyinc:common-spring-boot (>=79, <=92), com.heapbrain:heapaudit (1.0.0) +6 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.groupbyinc:common-spring-boot =79, =1.0.1, =1.0.1,...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41729 Source advisory: GHSA-J388-8RM5-P9...

com.github.zhycn:xbird-starter-swagger2 (>=1.0.0, <=1.3.0), com.heapbrain:testdeed (>=1.2.6, <=1.3.2) +11 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.9.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.zhycn:xbird-starter-swagger2 =1.0.0, =1.2.6,...

org.springframework.boot:spring-boot-starter-data-rest (>=1.5.11.release, <=1.5.12.release), org.springframework.data:spring-data-rest-hal-browser (2.6.11.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.11.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

GHSA-J388-8RM5-P97F Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

GHSA-6RPQ-6VV2-5222 Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

com.bushidowallet:bushido-service-lib (>=1.0.0, <=1.0.3), com.github.camel-labs:camel-labs-iot-cloudlet-document-driver (0.1.0) +23 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.6.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.6.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.bushidowallet:bushido-service-lib =1.0.0, =0.5.17, =1.14,...

com.lordofthejars:nosqlunit-mongodb (>=0.9.0, <=1.0.0), org.grails:grails-datastore-gorm-mongodb (>=3.0.2.release, <=3.1.5.release) +9 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.7.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.9.0, =3.0.2.release,...

EUVD-2026-35885

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...