org.smarti18n:smarti18n-messages (>=1.0.0, <=1.0-pre7), org.springdoc:springdoc-openapi-test-app3 (3.1.1) +5 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.14.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.smarti18n:smarti18n-messages =1.0.0, =5.0.13.release,...

org.springframework.boot:spring-boot-starter-data-mongodb (2.1.15.release), org.springframework.boot:spring-boot-starter-data-mongodb-reactive (2.1.15.release) +2 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.18.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.boot:spring-boot-starter-data-mongodb...

com.orange.fiware:openlpwa-iotagent (>=1.0.1, <=1.0.2), de.digitalcollections:iiif-bookshelf-webapp (>=2.2.0, <=2.3.0) +109 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.8.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.8.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.orange.fiware:openlpwa-iotagent =1.0.1, =2.2.0, =5.0.0.m1,...

be.appify.prefab:prefab-annotation-processor (>=0.7.0, <=0.10.9), be.appify.prefab:prefab-mongodb (>=0.5.0, <=0.10.9) +123 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-mongodb MAVEN version =5.0.0, =0.7.0, =0.5.0, =0.5.0, =4.0.0.0-m2, =4.0.0.0-m2, =1.0.1, =1.0.1, =3.0.0, =4.0.0, =4.3.1, =0.0.1, =0.0.2, =0.0.2, =1.0.4 - com.mzinx:mongodb-spring-materialized-view 1.0.0 and more Source cves: CVE-2026-41717 Source advisory:...

io.gravitee.gateway.standalone:gravitee-gateway-standalone-container (>=0.2.0, <=0.7.0), io.gravitee.gateway.standalone:gravitee-gateway-standalone-distribution (>=0.2.0, <=0.7.0) +12 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.7.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.7.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

cn.craccd:mongohelper (>=0.1.0, <=0.2.7), cn.dev8:ktmvc (>=0.1.28, <=0.1.39) +34 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.2.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - cn.craccd:mongohelper =0.1.0, =0.1.28, =0.1.10, =2.0.0, =0.1.0,...

com.github.lkqm:spring-data-mongodb-extends (0.1.0), io.flamingock:mongodb-springdata-v2-driver (>=0.0.10-beta, <=0.0.32-beta) +3 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.2.13.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.lkqm:spring-data-mongodb-extends 0.1.0 -...

ai.platon.commons:distributed-lock-example (>=1.4.2, <=1.4.3), ai.platon.commons:distributed-lock-mongo (>=1.4.2, <=1.4.3) +628 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=3.0.0.release, <=3.4.18)

org.springframework.data:spring-data-mongodb MAVEN version =3.0.0.release, =1.4.2, =1.4.2, =1.6.6, =1.6.6, =0.0.1, =0.1.0, =0.1.0, =1.1.13, =1.0.7, =1.0.7, =0.0.1, =0.0.5, =1.1.0, =2.1.0 and more Source cves: CVE-2026-41717 Source advisory: GHSA-5WHC-4Q84-FJ73...

org.springframework.data:spring-data-mongodb-cross-store (1.9.4.release), org.springframework.session:spring-session-data-mongo (>=1.3.0.release, <=1.3.3.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.9.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.9.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

org.gjgr.pig:pig-chivalrous-mongo (0.0.1.20201207g), org.springframework.data:spring-data-mongodb-cross-store (2.0.1.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.gjgr.pig:pig-chivalrous-mongo 0.0.1.20201207g -...

Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

com.sharethis:mongomigration (1.0.0), org.resthub:resthub-mongodb (>=2.1.4, <=2.1.6) +1 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.3.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.sharethis:mongomigration 1.0.0 - org.resthub:resthub-mongod...

org.resthub:resthub-mongodb (2.1.3), org.springframework.data:spring-data-mongodb-cross-store (1.2.4.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.2.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.resthub:resthub-mongodb 2.1.3 -...

org.springframework.data:spring-data-mongodb-cross-store (2.1.13.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.13.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.github.eagle6688:devutility.external (>=1.0, <=1.0.4), org.springframework.data:spring-data-mongodb-cross-store (2.0.4.release) +2 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.eagle6688:devutility.external =1.0, =2.0.1.release,...

org.springframework.boot:spring-boot-starter-data-elasticsearch (>=1.1.11.release, <=1.1.12.release), org.springframework.boot:spring-boot-starter-data-jpa (>=1.1.11.release, <=1.1.12.release) +22 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.8.5.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.boot:spring-boot-starter-data-elasticsearch...

com.lordofthejars:nosqlunit-mongodb (>=0.9.0, <=1.0.0), org.grails:grails-datastore-gorm-mongodb (>=3.0.2.release, <=3.1.5.release) +9 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.7.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.9.0, =3.0.2.release,...

org.springframework.data:spring-cql (1.0.6.release), org.springframework.data:spring-data-cassandra (1.0.6.release) +13 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.8.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.0.6.release -...

org.springframework.data:spring-data-jpa (1.4.0.release), org.springframework.data:spring-data-mongodb (1.3.0.release) +4 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.6.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.6.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-data-jpa 1.4.0.release -...

com.soterianetworks:spase-audit (>=0.9.27, <=0.9.59), org.resthub:resthub-common (2.1.3) +12 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.5.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.soterianetworks:spase-audit =0.9.27, =0.9.59 -...