org.smarti18n:smarti18n-messages (>=1.0.0, <=1.0-pre7), org.springdoc:springdoc-openapi-test-app3 (3.1.1) +5 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.14.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.smarti18n:smarti18n-messages =1.0.0, =5.0.13.release,...

com.antelopesystem.crudframework:crud-framework-mongo-connector (>=0.1.0, <=0.5.0), com.antelopesystem.crudframework:crud-framework-utils (>=0.1.1, <=0.5.0) +4 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.13.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.antelopesystem.crudframework:crud-framework-mongo-connecto...

com.github.softbasic:micro-core (>=0.0.1, <=0.0.6), org.springframework.boot:spring-boot-starter-data-mongodb (2.0.7.release) +4 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.12.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.softbasic:micro-core =0.0.1, =2.0.4.release,...

com.2oi7:file-uploader (1.0.0), com.antheminc.oss:nimbus-starter (>=1.3.0.m1, <=1.3.2.m1) +20 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.10.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.2oi7:file-uploader 1.0.0 - com.antheminc.oss:nimbus-starte...

cloud.altemista.fwk.persistence:cloud-altemistafwk-core-persistence-mongodb-conf (>=3.0.0.release, <=3.0.1.release), com.github.paulcwarren:content-mongo-spring-boot-starter (>=0.3.0, <=0.4.0) +18 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.9.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

bd.ac.seu.erp:model (>=0.0.1, <=0.0.2), com.avides.springboot.testcontainer:springboot-testcontainer-mongodb (>=0.1.0-rc3, <=0.1.0-rc4) +24 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.7.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - bd.ac.seu.erp:model =0.0.1, =0.1.0-rc3, =0.14, =3.0.16, =3.0.16...

com.github.eagle6688:devutility.external.mongo (>=2.0.6.1, <=2.0.6.4), com.github.krraghavan:mongodb-aggregate-query-support-reactive (>=0.8.0, <=0.8.4) +15 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.6.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.eagle6688:devutility.external.mongo =2.0.6.1, =0.8.0...

ch.sahits.game:openpatriciantest (>=0.9.1-rc1, <=0.9.1), cn.minsin:mutils-data-mongodb (>=0.0.2.release, <=0.4.0.release) +14 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.5.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - ch.sahits.game:openpatriciantest =0.9.1-rc1, =0.0.2.release,...

com.github.eagle6688:devutility.external (>=1.0, <=1.0.4), org.springframework.data:spring-data-mongodb-cross-store (2.0.4.release) +2 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.eagle6688:devutility.external =1.0, =2.0.1.release,...

org.springframework.data:spring-data-mongodb-cross-store (2.0.3.release), org.springframework.integration:spring-integration-mongodb (5.0.1.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.efindi:smo-filter (0.0.1-release), org.springframework.data:spring-data-mongodb-cross-store (2.0.2.release) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.efindi:smo-filter 0.0.1-release -...

org.gjgr.pig:pig-chivalrous-mongo (0.0.1.20201207g), org.springframework.data:spring-data-mongodb-cross-store (2.0.1.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.gjgr.pig:pig-chivalrous-mongo 0.0.1.20201207g -...

com.antheminc.oss:nimbus-core (>=1.1.7, <=1.2.0), com.antheminc.oss:nimbus-entity-dsl (>=1.1.7, <=1.2.0) +10 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.10.12.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.antheminc.oss:nimbus-core =1.1.7, =1.1.7, =1.1.7, =1.1.7,...

EUVD-2026-35893

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

GHSA-8R2H-XH92-GQ57 Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

GHSA-5VPF-XVV7-C8VH Spring Data Commons: StackOverflowException when parsing Sort parameters (DoS)

Applications using Spring Data Commons may be vulnerable to a Denial of Service DoS attack leading to a StackOverflowException when parsing Sort parameters. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through...

Spring Data Commons: StackOverflowException when parsing Sort parameters (DoS)

Applications using Spring Data Commons may be vulnerable to a Denial of Service DoS attack leading to a StackOverflowException when parsing Sort parameters. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through...

Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

GHSA-5WHC-4Q84-FJ73 Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...