net.dreamlu:mica-plus-mongo (1.2.2), org.springframework.boot:spring-boot-starter-data-mongodb (2.1.13.release) +13 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.16.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - net.dreamlu:mica-plus-mongo 1.2.2 -...

ch.sahits.game:openpatriciantest (>=1.0.0, <=1.0.1), com.alipay.sofa:sofa-tracer-mongodb-plugin (>=3.1.0, <=3.1.2) +22 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - ch.sahits.game:openpatriciantest =1.0.0, =3.1.0, =2.1.0.release...

com.github.aidensuen:mongodao-core (>=1.0.1, <=1.1.2), com.github.aidensuen:mongodao-pagehelper (>=1.0.3, <=1.1.2) +30 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.aidensuen:mongodao-core =1.0.1, =1.0.3, =1.0.3,...

org.smarti18n:smarti18n-messages (>=1.0.0, <=1.0-pre7), org.springdoc:springdoc-openapi-test-app3 (3.1.1) +5 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.14.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.smarti18n:smarti18n-messages =1.0.0, =5.0.13.release,...

org.springframework.data:spring-cql (1.0.6.release), org.springframework.data:spring-data-cassandra (1.0.6.release) +13 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.8.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.0.6.release -...

com.bushidowallet:bushido-address-watcher (>=1.0.0, <=1.0.1), com.bushidowallet:bushido-wallet-service (>=1.0.0, <=1.0.1) +21 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.5.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.bushidowallet:bushido-address-watcher =1.0.0, =1.0.0, =4.0....

Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

com.github.aidensuen:mongodao-core (>=1.0.1, <=1.1.2), com.github.aidensuen:mongodao-pagehelper (>=1.0.3, <=1.1.2) +30 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.aidensuen:mongodao-core =1.0.1, =1.0.3, =1.0.3,...

br.com.archbase:archbase-annotation-processor (>=1.0.1, <=1.0.31), br.com.archbase:archbase-app-framework (>=1.0.1, <=1.0.31) +455 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=3.0.0, <=3.3.13)

org.springframework.data:spring-data-relational MAVEN version =3.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.31 and more Source cves: CVE-2026-41697 Source advisory: GHSA-8R2H-XH92-GQ57...

com.aol.microservices:micro-data (>=0.62, <=0.64), com.aol.microservices:microserver-data (>=0.60, <=0.61) +127 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.9.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.9.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.aol.microservices:micro-data =0.62, =0.60, =1.0.0,...

org.inigma.shared:inigma-mongo (>=0.6.1, <=0.10.0), org.springframework.data:spring-data-mongodb-cross-store (1.1.2.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.1.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.inigma.shared:inigma-mongo =0.6.1, =0.10.0 -...

be.appify.prefab:prefab-annotation-processor (>=0.7.0, <=0.10.9), be.appify.prefab:prefab-mongodb (>=0.5.0, <=0.10.9) +123 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-mongodb MAVEN version =5.0.0, =0.7.0, =0.5.0, =0.5.0, =4.0.0.0-m2, =4.0.0.0-m2, =1.0.1, =1.0.1, =3.0.0, =4.0.0, =4.3.1, =0.0.1, =0.0.2, =0.0.2, =1.0.4 - com.mzinx:mongodb-spring-materialized-view 1.0.0 and more Source cves: CVE-2026-41696 Source advisory:...

EUVD-2026-35892

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

cn.dev8:ktmyoql (>=0.0.1, <=0.0.7), com.avides.springboot.testcontainer:springboot-testcontainer-mongodb (>=0.1.0-rc7, <=0.1.0-rc10) +25 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - cn.dev8:ktmyoql =0.0.1, =0.1.0-rc7, =1.0.4, =0.3.0, =0.28.0,...

org.springframework.data:spring-data-mongodb-cross-store (2.1.7.release), org.springframework.integration:spring-integration-mongodb (5.1.5.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.7.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.antelopesystem.crudframework:crud-framework-mongo-connector (>=0.1.0, <=0.5.0), com.antelopesystem.crudframework:crud-framework-utils (>=0.1.1, <=0.5.0) +4 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.13.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.antelopesystem.crudframework:crud-framework-mongo-connecto...

org.springframework.data:spring-data-mongodb-cross-store (2.0.0.release), org.tmurakam:spring-session-ext-mongo (1.5.0) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

GHSA-HC43-M36C-8V33 Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

org.grails:grails-datastore-gorm-mongo (>=1.0.0.rc5, <=1.0.0.release), org.grails:grails-datastore-mongo (>=1.0.0.rc5, <=1.0.0.release) +2 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.0.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:grails-datastore-gorm-mongo =1.0.0.rc5, =1.0.0.rc5,...

com.capitalone.dashboard:api (>=3.3.0, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.5.1, <=3.7.33) +15 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.23.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.capitalone.dashboard:api =3.3.0, =3.5.1, =3.2.0, =3.10.0,...