com.capitalone.dashboard:hygieia-common (>=4.0.1, <=4.1.0), com.eworkcloud.starter:ework-cloud-starter-mongo (>=2.1.7, <=2.2.2) +11 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.2.8.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.capitalone.dashboard:hygieia-common =4.0.1, =2.1.7, =1.30.0...

com.aol.microservices:micro-data (>=0.65, <=0.69), com.aol.microservices:micro-hibernate (>=0.70, <=0.72) +69 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.11.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.11.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.aol.microservices:micro-data =0.65, =0.70, =0.69, =1.5.0,...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-40988 Source advisory: GHSA-M69X-PW9P-7J3Q...

com.eworkcloud.starter:ework-cloud-starter-mongo (>=2.0.0, <=2.0.3), com.eworkcloud:ework-cloud-starter-mongo (>=2.2.0, <=2.2.1) +24 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.2.5.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.eworkcloud.starter:ework-cloud-starter-mongo =2.0.0, =2.2.0...

org.springframework.data:spring-data-mongodb-cross-store (1.10.21.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.21.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

org.springframework.data:spring-data-mongodb-cross-store (1.10.2.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.epam.reportportal:commons-dao (3.0.0), com.epam.reportportal:commons-rules (3.0.0) +185 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.epam.reportportal:commons-dao 3.0.0 -...

org.springframework.data:spring-data-mongodb-cross-store (2.1.7.release), org.springframework.integration:spring-integration-mongodb (5.1.5.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.7.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.airlenet:play-repo-mongo (2.0.0), com.bol:spring-data-mongodb-encrypt (>=1.0, <=1.3.0) +190 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.airlenet:play-repo-mongo 2.0.0 -...

GHSA-6RPQ-6VV2-5222 Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

com.epam.reportportal:commons-dao (>=3.1.2, <=3.3.2), com.epam.reportportal:commons-rules (>=3.1.1, <=3.3.0) +231 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.6.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.epam.reportportal:commons-dao =3.1.2, =3.1.1, =3.1.2,...

org.gjgr.pig:pig-chivalrous-mongo (0.0.1.20201207g), org.springframework.data:spring-data-mongodb-cross-store (2.0.1.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.gjgr.pig:pig-chivalrous-mongo 0.0.1.20201207g -...

com.antheminc.oss:nimbus-core (>=1.1.7, <=1.2.0), com.antheminc.oss:nimbus-entity-dsl (>=1.1.7, <=1.2.0) +10 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.12.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.antheminc.oss:nimbus-core =1.1.7, =1.1.7, =1.1.7, =1.1.7,...

de.adorsys.psd2:aspsp-mock-server (>=1.13, <=3.0), net.jworkflow:jworkflow.providers.mongodb (1.0) +4 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.17.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - de.adorsys.psd2:aspsp-mock-server =1.13, =3.0 -...

com.shibgeek.cip.source-generator:com.shibgeek.cip.source-generator.gradle.plugin (>=0.1.2, <=0.1.4), de.adorsys.aspsp:aspsp-mock-server (>=1.7, <=1.10-rc1) +37 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.15.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

at.rodrigo.api.gateway:api-gateway-entity (1.3.2), com.9isuper.pelecanus:pelecanus-data-mongodb (1.0.3.m1) +48 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.10.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - at.rodrigo.api.gateway:api-gateway-entity 1.3.2 -...

io.gravitee.gateway.standalone:gravitee-gateway-standalone-container (>=0.2.0, <=0.7.0), io.gravitee.gateway.standalone:gravitee-gateway-standalone-distribution (>=0.2.0, <=0.7.0) +12 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.7.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.7.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

com.github.eagle6688:devutility.external.mongo (>=1.10.11.1, <=1.10.11.9), com.lodsve:lodsve-mongodb (>=2.7.2-release, <=2.7.6-release) +9 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.11.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.eagle6688:devutility.external.mongo =1.10.11.1,...

com.epam.reportportal:commons-bugtracking (4.2.0), com.github.mujun0312:zxspace-booster-build (>=1.0.1.release, <=1.0.3.release) +25 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.10.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.epam.reportportal:commons-bugtracking 4.2.0 -...

com.trigyn:java-web-starter (>=1.6.0, <=2.1), com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.9.0, <=11.9.5.ee) +22 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=6.3.1, <=6.3.6)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.3.1, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0 and more Source cves: CVE-2026-41694 Source advisory:...