Allocation of Resources Without Limits or Throttling

Overview org.springframework.data:spring-data-commons is a maven plugin to centralize common resources and configuration for Spring Data Maven builds. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the property-lookup cache. An attacke...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.120.0) +9201 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (>=3.0.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.0.0, =0.1.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41716 Source advisory:...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2375 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (>=4.0.0-m1, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0-m1, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41716 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-17308778...

ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.120.0), ai.driftkit:driftkit-context-engineering-services (>=0.7.9, <=0.9.2) +689 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=4.0.0, <=4.5.11)

org.springframework.data:spring-data-mongodb MAVEN version =4.0.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41717 Source advisory:...

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' via parameter binding when a repository query method is annotated with @Query and uses a capture-all placeholder. An...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +464 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=4.0.0-m1, <=4.0.5)

org.springframework.data:spring-data-keyvalue MAVEN version =4.0.0-m1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =6.0.1, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m3 and more Source cves: CVE-2026-41719 Source advisory:...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.120.0) +9201 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (>=3.0.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.0.0, =0.1.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41711 Source advisory:...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2375 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (>=4.0.0-m1, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0-m1, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41711 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-17304742...

Denial of Service (DoS)

Overview org.springframework.data:spring-data-commons is a maven plugin to centralize common resources and configuration for Spring Data Maven builds. Affected versions of this package are vulnerable to Denial of Service DoS via the MappingContext property path resolution. An attacker can cause...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.120.0) +9201 more potentially affected by CVE-2026-41695 via org.springframework.data:spring-data-commons (>=3.0.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.0.0, =0.1.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41695 Source advisory:...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2326 more potentially affected by CVE-2026-41695 via org.springframework.data:spring-data-commons (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41695 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-17295727...

be.personify.iam:personify-api (>=1.5.0.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release) +151 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=4.0.0, <=4.5.11)

org.springframework.data:spring-data-rest-core MAVEN version =4.0.0, =1.5.0.release, =1.5.1.release, =1.5.0.release, =2.1.0.release, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41729 Source advisory:...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +29 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-webmvc (>=5.0.0-m1, <=5.0.5)

org.springframework.data:spring-data-rest-webmvc MAVEN version =5.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =2026.06 - io.github.vsvyatski:content-fs-spring-boot-starter 4.0.0 - io.github.vsvyatski:content-jpa-spring-boot-starter 4.0.0 -...

be.personify.iam:personify-api (>=1.5.0.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release) +135 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-webmvc (>=4.0.0, <=4.5.11)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.0.0, =1.5.0.release, =1.5.1.release, =1.5.0.release, =2.1.0.release, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41729 Source advisory:...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=5.0.0-m1, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41729 Source advisory: SNYK:JAVA-ORGS...

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection'. in the processing of JSON Patch requests...

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Overview org.springframework.data:spring-data-rest-webmvc is a maven plugin for Spring Data REST - WebMVC. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' in the processing of...

Information Exposure

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Information Exposure. in the error response serialization. An attacker can gain access to sensitive internal information by triggering errors that cause the full...

Information Exposure

Overview org.springframework.data:spring-data-rest-webmvc is a maven plugin for Spring Data REST - WebMVC. Affected versions of this package are vulnerable to Information Exposure in the error response serialization. An attacker can gain access to sensitive internal information by triggering erro...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (>=5.0.0-m1, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41730 Source advisory: SNYK:JAVA-ORGS...