com.github.zengfr.project:com.github.zengfr.project.common (0.0.1), com.github.zengfr.project:com.github.zengfr.project.pom (0.0.1) +9 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.3.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.zengfr.project:com.github.zengfr.project.common...

org.springframework.boot:spring-boot-starter-data-rest (1.5.5.release), org.springframework.data:spring-data-rest-hal-browser (2.6.5.release) +1 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.ixortalk:ixortalk-authorization-server (>=0.0.1, <=0.0.6), org.springframework.boot:spring-boot-starter-data-rest (1.5.21.release) +2 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.22.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.ixortalk:ixortalk-authorization-server =0.0.1, =0.0.6 ...

com.netflix.spectator:spectator-web-spring (>=0.41.0, <=0.42.0), org.springframework.boot:spring-boot-starter-data-rest (>=1.2.7.release, <=1.2.8.release) +1 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.2.4.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.netflix.spectator:spectator-web-spring =0.41.0,...

com.github.codefrogcc:allocation (>=1.0.0, <=1.1.4), com.github.codefrogcc:commons-config (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.13.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.codefrogcc:allocation =1.0.0, =1.0.0, =2.9.1,...

org.springframework.boot:spring-boot-starter-data-rest (1.4.6.release), org.springframework.data:spring-data-rest-hal-browser (2.5.10.release) +1 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.5.10.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.github.liuzhongkai:spider-boot-restdoc (>=2.3.0-release, <=2.3.1-release), com.github.paulcwarren:content-rest-spring-boot-starter (>=0.0.6, <=0.0.8) +10 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.6.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.liuzhongkai:spider-boot-restdoc =2.3.0-release,...

cn.jiangzeyin.fast-boot:common-redis (>=1.0.3, <=1.2.39), cn.jiangzeyin:common-redis (>=1.0.0, <=1.0.3) +15 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.11.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.jiangzeyin.fast-boot:common-redis =1.0.3, =1.0.0, =0.0.1,...

de.idealo.kafka:kafka-encryption (0.1-20180118), de.idealo.kafka:kafka-encryption-demo-app (>=0.1-20180111, <=0.1-20180118) +1 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.3.2.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - de.idealo.kafka:kafka-encryption 0.1-20180118 -...

com.buession.cas:cas-server-support-logging (>=3.0.0, <=3.0.1), com.buession.cas:cas-server-support-logging-core (>=3.0.0, <=3.0.1) +101 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=2.9.0, <=2.9.13)

org.springframework.kafka:spring-kafka MAVEN version =2.9.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =0.1.34, =1.3.0, =1.1.3, =1.2.3 - com.infobip.kafkistry:kafkistry-app 0.3.0 - com.infobip.kafkistry:kafkistry-auditing 0.3.0 - com.infobip.kafkistry:kafkistry-consume 0.3.0 -...

com.ueboot:ueboot-generator (2.2.0), com.ueboot:ueboot-shiro (2.2.0) +14 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.15.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.ueboot:ueboot-generator 2.2.0 - com.ueboot:ueboot-shiro...

EUVD-2026-35905

Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...

com.github.micromix:micromix-compendium-crud (0.4), com.shigengyu:hyperion (0.0.1) +38 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.6.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.6.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.micromix:micromix-compendium-crud 0.4 -...

org.springframework.boot:spring-boot-starter-data-rest (1.5.18.release), org.springframework.data:spring-data-rest-hal-browser (2.6.17.release) +1 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.17.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.github.codefrogcc:allocation (>=1.0.0, <=1.1.4), com.github.codefrogcc:commons-config (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.13.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.codefrogcc:allocation =1.0.0, =1.0.0, =2.9.1,...

org.springframework.boot:spring-boot-starter-data-rest (1.1.4.release), org.springframework.data:spring-data-rest-webmvc (2.1.1.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.1.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.github.jknack:mwa-mongo (0.4.0), com.github.jknack:mwa-morphia (0.4.0) +14 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.5.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.5.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.jknack:mwa-mongo 0.4.0 - com.github.jknack:mwa-morph...

org.springframework.boot:spring-boot-starter-data-rest (1.5.5.release), org.springframework.data:spring-data-rest-hal-browser (2.6.5.release) +1 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +110 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.12.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =1.0.1, =3.0.1.3...

GHSA-P5MM-XWGQ-WHFR Spring Data REST potentially exposes persistence-layer internals to HTTP clients

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...