com.btmatthews.atlas:atlas-mongodb (1.0.0), com.github.microon:microon-services-userdirectory (0.0) +6 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.2.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.btmatthews.atlas:atlas-mongodb 1.0.0 -...

org.springframework.data:spring-data-mongodb-cross-store (1.7.0.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.7.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.7.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.github.acierto:aciertoteam-common (1.1.0), com.github.acierto:aciertoteam-geo (1.1.0) +36 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.10.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.10.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.acierto:aciertoteam-common 1.1.0 -...

ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.112.0), ai.driftkit:driftkit-context-engineering-services (>=0.7.9, <=0.9.2) +488 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=4.0.0, <=4.3.13)

org.springframework.data:spring-data-mongodb MAVEN version =4.0.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41717 Source advisory: OSV:GHSA-5WHC-4Q84-FJ73...

org.ozwillo.datacore:ozwillo-datacore-core (1.10.1), org.springframework.boot:spring-boot-starter-data-mongodb (1.1.5.release) +1 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.5.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.5.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.ozwillo.datacore:ozwillo-datacore-core 1.10.1 -...

de.adorsys.multibanking:multibanking-persistence-mongodb (5.5.24), de.adorsys.multibanking:multibanking-server (5.5.24) +3 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.20.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - de.adorsys.multibanking:multibanking-persistence-mongodb 5.5.2...

com.efindi:smo-filter (0.0.1-release), org.springframework.data:spring-data-mongodb-cross-store (2.0.2.release) +3 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.efindi:smo-filter 0.0.1-release -...

CVE-2026-41730

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

CVE-2026-41837

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

CVE-2026-41728

Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...

CVE-2026-41729

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

CVE-2026-41711

Applications using Spring Data Commons may be vulnerable to a Denial of Service DoS attack leading to a StackOverflowException when parsing Sort parameters. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through...

CVE-2026-41719

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

CVE-2026-41716

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11;...

CVE-2026-41717

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41721

Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...

CVE-2026-41697

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

CVE-2026-41695

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through...

CVE-2026-41696

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

VMware Spring Data REST Access Control Vulnerability

VMware Spring Data REST is a data interface provided by the American company VMware. It is used to build domain models based on Spring Data repositories, and to expose hypermedia-driven HTTP resources for aggregates contained within those models. VMware Spring Data REST versions 3.7.0 and earlier...