com.sap.research.security.vulas:rest-backend (>=3.1.6, <=3.1.15), org.sakaiproject.edu-services.gradebook:gradebook-service-impl (>=20.0, <=20.6) +6 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.23.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.sap.research.security.vulas:rest-backend =3.1.6, =20.0...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +82 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-rest-core MAVEN version =4.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41728 Source advisory: GHSA-CV39-X4C6-HHP2...

org.springframework.data:spring-data-rest-hal-browser (2.5.4.release), org.springframework.data:spring-data-rest-webmvc (2.5.4.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.5.4.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

com.wueasy:wueasy-base-web (>=1.2.0, <=1.3.3), com.wueasy:wueasy-gateway (>=1.4.0, <=1.4.2) +11 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.18.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.wueasy:wueasy-base-web =1.2.0, =1.4.0, =1.3.0,...

cn.stylefeng.roses:kernel-logger (>=1.0.0, <=2.2.3), com.github.lujiannt:kernel-logger (1.0.0) +4 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.2.2.release)

org.springframework.kafka:spring-kafka MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - cn.stylefeng.roses:kernel-logger =1.0.0, =0.0.2, =0.0.2, =5.2.0-rc1,...

io.fabric8:process-spring-boot-itests-service-invoicing (>=1.2.0.beta2, <=1.2.0.beta3), org.springframework.boot:spring-boot-starter-data-rest (1.1.5.release) +1 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.1.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8:process-spring-boot-itests-service-invoicing...

am.ik.home:uaa-server (>=1.0.0, <=1.2.0), org.springframework.boot:spring-boot-starter-data-rest (1.4.3.release) +2 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.5.6.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - am.ik.home:uaa-server =1.0.0, =1.2.0 -...

ai.apiverse:apipulse (1.0.1), app.commerce-io:spring-boot-starter-data-search-jpa (>=1.1.0-rc1, <=1.3.0) +385 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=3.0.0.release, <=3.7.18)

org.springframework.data:spring-data-rest-core MAVEN version =3.0.0.release, =1.1.0-rc1, =1.0.1.release, =1.0.0.release, =1.0.1.release, =1.1.8.release, =1.1.5.release, =1.0.0, =1.4.0, =1.6.0 - co.bittub.api:core 1.0.0 - com.9isuper.pelecanus:pelecanus-data-jpa 1.0.3.m1 -...

com.sksamuel.elasticsearch:elasticsearch-river-neo4j (>=0.90.7.0, <=0.90.9.0), org.springframework.data:spring-cql (1.3.6.release) +15 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.11.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.11.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.sksamuel.elasticsearch:elasticsearch-river-neo4j =0.90.7.0...

io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.beta6, <=1.1.0.cr1), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.beta6, <=1.1.0.cr1) +2 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.0.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.beta...

org.springframework.data:spring-data-rest-hal-browser (2.4.0.release), org.springframework.data:spring-data-rest-webmvc (2.4.0.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.4.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

org.springframework.data:spring-data-rest-hal-browser (2.6.21.release), org.springframework.data:spring-data-rest-webmvc (2.6.21.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.21.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

org.springframework.data:spring-data-rest-webmvc (2.0.3.release) potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.0.3.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

org.springframework.boot:spring-boot-starter-data-rest (1.5.20.release), org.springframework.data:spring-data-rest-hal-browser (2.6.20.release) +1 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.20.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

GHSA-CV39-X4C6-HHP2 Spring Data REST has Improper Access Control in its JSON Patch Implementation

Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...

Spring Data Commons: Denial of Service via excessive memory allocation in projection binding

Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...

EUVD-2026-35902

Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lo...

org.springframework.data:spring-data-rest-hal-browser (2.5.0.release), org.springframework.data:spring-data-rest-webmvc (2.5.0.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.5.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

EUVD-2026-35906

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

GHSA-53W6-V7CV-FC9H Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence Manipulation

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retrytopic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the...