com.ueboot:ueboot-generator (2.2.0), com.ueboot:ueboot-shiro (2.2.0) +14 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.15.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.ueboot:ueboot-generator 2.2.0 - com.ueboot:ueboot-shiro...

com.github.binarywang:weixin-java-common (>=3.7.7.b, <=3.9.0), com.github.fangjinuo.agileway:agileway-redis (>=2.0.0, <=3.1.12) +31 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.23.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.github.binarywang:weixin-java-common =3.7.7.b, =2.0.0,...

cc.alans.netty-plus:netty-plus (1.0.0), cc.uncarbon.framework:helio-starter-rate-limit-redis (>=2.3.0, <=2.4.1) +820 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-keyvalue MAVEN version =3.4.0, =2.3.0, =2.3.0, =2.3.0, =0.0.1, =1.7.0.v3, =5.0.5, =3.2.5, =4.1.3 and more Source cves: CVE-2026-41719 Source advisory: OSV:GHSA-XG2J-3HJ6-PC24...

org.springframework.data:spring-data-redis (1.8.21.release) potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.21.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.data:spring-data-redis 1.8.21.release...

ai.hyacinth.framework:core-service-cache-support (>=0.5.0, <=0.5.5), ai.hyacinth.framework:core-service-gateway-server (>=0.5.0, <=0.5.24) +5020 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=2.0.0.release, <=2.7.18)

org.springframework.data:spring-data-keyvalue MAVEN version =2.0.0.release, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =finchley.sr2.sr1, =2.0.1.release, =1.1.0.release, =1.0.3.release, =1.0.0, =1.0.6, =0.5.0, =0.1.0, =0.3.0, =0.5.0, =0.8.0 and more Source cves: CVE-2026-41719 Source advisory:...

org.springframework.data:spring-data-redis (1.7.9.release) potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.9.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.data:spring-data-redis 1.7.9.release Sour...

org.springframework.data:spring-data-redis (1.8.2.release) potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.2.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.data:spring-data-redis 1.8.2.release Sour...

com.github.upers:betexdao (>=1.0.0, <=1.2.7), com.nepxion:discovery-common-redis (>=edgware.1.0.0, <=3.14.0) +13 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.17.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.github.upers:betexdao =1.0.0, =edgware.1.0.0,...

com.wueasy:wueasy-base-web (>=1.2.0, <=1.3.3), com.wueasy:wueasy-gateway (>=1.4.0, <=1.4.2) +11 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.18.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.wueasy:wueasy-base-web =1.2.0, =1.4.0, =1.3.0,...

com.epam.reportportal:commons-bugtracking (2.7.0), com.epam.reportportal:commons-dao (>=2.7.0, <=2.7.1.1) +41 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.3.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.epam.reportportal:commons-bugtracking 2.7.0 -...

be.personify.iam:personify-api (>=1.5.3.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release) +29 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (>=4.4.0, <=4.4.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.4.0, =1.5.3.release, =1.5.4.release, =1.5.4.release, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.11.1, =0.11.1, =0.11.1, =0.11.1, =3.0.16, =3.0.16, =3.0.17 and more Source cves: CVE-2026-41728 Source advisory: OSV:GHSA-C...

GHSA-CV39-X4C6-HHP2 Spring Data REST has Improper Access Control in its JSON Patch Implementation

Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...

Spring Data Commons: Denial of Service via excessive memory allocation in projection binding

Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...

EUVD-2026-35902

Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...

com.github.codinghck:utils (1.1.1-release), com.twosigma.webtau:webtau-docs (>=1.16, <=1.20) +17 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.7.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.codinghck:utils 1.1.1-release -...

org.springframework.data:spring-data-rest-hal-browser (2.5.0.release), org.springframework.data:spring-data-rest-webmvc (2.5.0.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.5.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2326 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41721 Source advisory: OSV:GHSA-5M4M-73W9-8433...

EUVD-2026-35906

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

GHSA-XG2J-3HJ6-PC24 Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

com.github.liuzhongkai:spider-boot-restdoc (>=2.3.0-release, <=2.3.1-release), com.github.paulcwarren:content-rest-spring-boot-starter (>=0.0.6, <=0.0.8) +10 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.6.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.liuzhongkai:spider-boot-restdoc =2.3.0-release,...