com.groupbyinc:common-spring-boot (>=79, <=92), com.heapbrain:heapaudit (1.0.0) +6 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.groupbyinc:common-spring-boot =79, =1.0.1, =1.0.1,...

org.springframework.boot:spring-boot-starter-data-rest (1.4.6.release), org.springframework.data:spring-data-rest-hal-browser (2.5.10.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.10.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.springframework.data:spring-data-rest-webmvc (2.2.0.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.2.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

org.springframework.boot:spring-boot-starter-data-rest (1.4.5.release), org.springframework.data:spring-data-rest-hal-browser (2.5.8.release) +1 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.5.8.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.springframework.data:spring-data-rest-hal-browser (2.6.21.release), org.springframework.data:spring-data-rest-webmvc (2.6.21.release) potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.21.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

am.ik.home:uaa-server (>=1.0.0, <=1.2.0), org.springframework.boot:spring-boot-starter-data-rest (1.4.3.release) +2 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.5.6.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - am.ik.home:uaa-server =1.0.0, =1.2.0 -...

com.epam.reportportal:commons-bugtracking (3.0.0), com.github.haosenwei:g4m-com (1.0-releases) +3 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.8.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.epam.reportportal:commons-bugtracking 3.0.0 -...

com.ueboot:ueboot-generator (2.2.0), com.ueboot:ueboot-shiro (2.2.0) +13 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.15.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.ueboot:ueboot-generator 2.2.0 - com.ueboot:ueboot-shir...

EUVD-2026-35901

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

org.springframework.boot:spring-boot-starter-data-rest (1.4.5.release), org.springframework.data:spring-data-rest-hal-browser (2.5.8.release) +1 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.5.8.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

co.aurasphere.botmill:botmill-core (>=1.0.0, <=1.0.2), co.aurasphere.botmill:fb-botmill (>=2.0.0-rc1, <=2.0.0-rc3) +30 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.5.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - co.aurasphere.botmill:botmill-core =1.0.0, =2.0.0-rc1, =1.1,...

com.github.liuzhongkai:spider-boot-restdoc (>=2.3.0-release, <=2.3.1-release), com.github.paulcwarren:content-rest-spring-boot-starter (>=0.0.6, <=0.0.8) +10 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.6.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.liuzhongkai:spider-boot-restdoc =2.3.0-release,...

org.springframework.boot:spring-boot-starter-data-rest (1.4.5.release), org.springframework.data:spring-data-rest-hal-browser (2.5.8.release) +1 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.5.8.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.ganshane.lichen:lichen-activiti (>=0.5.9, <=0.5.10.2), com.ganshane.lichen:lichen-creeper (>=0.5.9, <=0.5.10.2) +63 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.8.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.ganshane.lichen:lichen-activiti =0.5.9, =0.5.9, =0.5.9,...

com.github.ydespreaux.spring.data:spring-data-jpa-criteria (1.0.1), com.wueasy:wueasy-base-web (>=1.2.0, <=1.3.3) +68 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.18.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.ydespreaux.spring.data:spring-data-jpa-criteria...

com.lordofthejars:nosqlunit-mongodb (>=0.9.0, <=1.0.0), org.grails:grails-datastore-gorm-mongodb (>=3.0.2.release, <=3.1.5.release) +9 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.7.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.9.0, =3.0.2.release,...

EUVD-2026-35910

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

Spring Data REST potentially exposes persistence-layer internals to HTTP clients

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...

Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

com.ifrabbit:spring-boot-starter-data-mybatis (1.0.17.release), com.ifrabbit:spring-data-mybatis (1.0.17.release) +28 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.5.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.ifrabbit:spring-boot-starter-data-mybatis 1.0.17.release -...