be.personify.iam:personify-api (>=1.5.0.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release) +135 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-webmvc (>=4.0.0, <=4.5.11)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.0.0, =1.5.0.release, =1.5.1.release, =1.5.0.release, =2.1.0.release, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41730 Source advisory:...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +29 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-webmvc (>=5.0.0-m1, <=5.0.5)

org.springframework.data:spring-data-rest-webmvc MAVEN version =5.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =2026.06 - io.github.vsvyatski:content-fs-spring-boot-starter 4.0.0 - io.github.vsvyatski:content-jpa-spring-boot-starter 4.0.0 -...

Access Control Bypass

Overview org.springframework.data:spring-data-rest-webmvc is a maven plugin for Spring Data REST - WebMVC. Affected versions of this package are vulnerable to Access Control Bypass in the Querydsl integration, which accepts arbitrary persistent property paths as request-parameter filter keys...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=5.0.0-m1, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41837 Source advisory: SNYK:JAVA-ORGS...

be.personify.iam:personify-api (>=1.5.0.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release) +135 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=4.0.0, <=4.5.11)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.0.0, =1.5.0.release, =1.5.1.release, =1.5.0.release, =2.1.0.release, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41837 Source advisory:...

Access Control Bypass

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Access Control Bypass. in the Querydsl integration, which accepts arbitrary persistent property paths as request-parameter filter keys without considering Jackson...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2375 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (>=4.0.0-m1, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0-m1, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41721 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-17279540...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.120.0) +9201 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (>=3.0.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.0.0, =0.1.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41721 Source advisory:...

Denial of Service (DoS)

Overview org.springframework.data:spring-data-commons is a maven plugin to centralize common resources and configuration for Spring Data Maven builds. Affected versions of this package are vulnerable to Denial of Service DoS via data binding. An attacker can exhaust system memory resources by...

com.github.paulcwarren:content-rest-spring-boot-starter (>=0.0.9, <=0.0.11), com.github.paulcwarren:spring-content-rest (>=0.0.9, <=0.0.11) +7 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.10.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.paulcwarren:content-rest-spring-boot-starter...

Spring Data REST has Improper Access Control in its JSON Patch Implementation

Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +82 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-rest-core MAVEN version =4.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41729 Source advisory: GHSA-J388-8RM5-P97F...

cn.springcloud.gray:spring-cloud-gray-server (>=a.1.1.1, <=a.2.0.0), cn.springcloud.gray:spring-cloud-gray-server-cluster-http-synchro-plugin (>=a.2.0.0.rc1, <=a.2.0.0) +171 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.23.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - cn.springcloud.gray:spring-cloud-gray-server =a.1.1.1,...

org.appverse.web.framework.modules.backend.frontfacade.mvc.schema:appverse-web-modules-backend-frontfacade-mvc-schema (2.0.0-rc4), org.springframework.boot:spring-boot-starter-data-rest (1.3.0.release) +2 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.4.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: -...

am.ik.home:uaa-server (1.9.0), com.github.ddewaele:springboot.crud.sample (0.0.10) +3 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - am.ik.home:uaa-server 1.9.0 -...

org.springframework.data:spring-data-rest-webmvc (2.3.0.release) potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.3.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

net.blugrid:blugrid-java-core (>=2.0.1, <=2.0.4-1), net.blugrid:blugrid-java-core-resources (>=2.0.3, <=2.0.3-7) +4 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.4.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - net.blugrid:blugrid-java-core =2.0.1, =2.0.3, =2.0.4,...

org.jsondoc:jsondoc-springmvc (>=1.2.14, <=1.2.23), org.springframework.data:spring-data-rest-hal-browser (2.5.1.release) +1 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.5.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.jsondoc:jsondoc-springmvc =1.2.14, =1.2.23 -...

org.springframework.data:spring-data-rest-repository (1.0.0.release), org.springframework.data:spring-data-rest-webmvc (1.0.0.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (1.0.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-repository...