com.epam.reportportal:commons-bugtracking (4.2.0), com.github.mujun0312:zxspace-booster-build (>=1.0.1.release, <=1.0.3.release) +25 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.10.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.epam.reportportal:commons-bugtracking 4.2.0 -...

com.trigyn:java-web-starter (>=1.6.0, <=2.1), com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.9.0, <=11.9.5.ee) +22 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=6.3.1, <=6.3.6)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.3.1, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0 and more Source cves: CVE-2026-41694 Source advisory:...

GHSA-X2R2-RVHQ-2MQV Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is us...

org.ozwillo.datacore:ozwillo-datacore-core (1.10.1), org.springframework.boot:spring-boot-starter-data-mongodb (1.1.5.release) +1 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.5.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.5.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.ozwillo.datacore:ozwillo-datacore-core 1.10.1 -...

com.17jee:e-cloud-authorize (3.0.0.release), com.17jee:e-cloud-gateway (>=3.0.0, <=3.0.1.1) +44 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.2.8.release)

org.springframework.security:spring-security-web MAVEN version 3.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.17jee:e-cloud-authorize 3.0.0.release -...

com.trigyn:java-web-starter (>=1.6.0, <=2.1), com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.9.0, <=11.9.5.ee) +22 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=6.3.1, <=6.3.6)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.3.1, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0 and more Source cves: CVE-2026-40988 Source advisory:...

be.appify.prefab:prefab-annotation-processor (>=0.1.0, <=0.1.1), be.appify.prefab:prefab-core (>=0.1.0, <=0.1.1) +669 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-relational MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41697 Source advisory: OSV:GHSA-8R2H-XH92-GQ57...

com.aukletapm.go:go-spring (>=1.5.0, <=1.6.0), com.epam.reportportal:commons-bugtracking (3.1.0) +11 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.aukletapm.go:go-spring =1.5.0, =0.7.18, =1.0.0, =2.0.1,...

com.2oi7:file-uploader (1.0.0), com.antheminc.oss:nimbus-starter (>=1.3.0.m1, <=1.3.2.m1) +20 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.10.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.2oi7:file-uploader 1.0.0 - com.antheminc.oss:nimbus-starte...

com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0, =1.52.0, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.6 Source cves: CVE-2026-41694 Source advisory: OSV:GHSA-WW38-37G9-M3Q3...

com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0, =1.52.0, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.6 Source cves: CVE-2026-40988 Source advisory: GHSA-M69X-PW9P-7J3Q...

cn.dev8:ktmyoql (>=0.1.0, <=0.1.8), com.avides.springboot.testcontainer:springboot-testcontainer-mongodb (1.0.0-rc1) +14 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.2.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - cn.dev8:ktmyoql =0.1.0, =4.0.0, =0.8.6, =0.0.2,...

me.wuwenbin:template-modules-mongodb (>=1.10.7.release, <=1.10.17.release), org.apereo.cas:cas-management-webapp (>=5.2.0-rc4, <=5.3.0-rc3) +280 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.7.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - me.wuwenbin:template-modules-mongodb =1.10.7.release,...

org.resthub:resthub-mongodb (2.1.3), org.springframework.data:spring-data-mongodb-cross-store (1.2.4.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.2.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.resthub:resthub-mongodb 2.1.3 -...

com.thinkbiganalytics.kylo.plugins:kylo-hadoop-authorization-ranger (>=0.8.3, <=0.9.1), com.thinkbiganalytics.kylo.plugins:kylo-ranger-rest-client (>=0.8.3, <=0.9.1) +33 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.12.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: -...

com.github.fangyanpg:spring-boot-ratelimiter (>=0.0.1-release, <=0.3.0-release), com.github.hushengte:disciples-feed (1.0.10) +53 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.22.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.fangyanpg:spring-boot-ratelimiter =0.0.1-release,...

com.github.lodsve:lodsve-amqp (>=2.4.8, <=2.5.7), org.springframework.amqp:spring-rabbit (1.5.3.release) +1 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.5.3.release)

org.springframework.amqp:spring-amqp MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.github.lodsve:lodsve-amqp =2.4.8, =2.5.7 -...

ai.platon.commons:distributed-lock-example (>=1.4.2, <=1.4.3), ai.platon.commons:distributed-lock-mongo (>=1.4.2, <=1.4.3) +628 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (>=3.0.0.release, <=3.4.18)

org.springframework.data:spring-data-mongodb MAVEN version =3.0.0.release, =1.4.2, =1.4.2, =1.6.6, =1.6.6, =0.0.1, =0.1.0, =0.1.0, =1.1.13, =1.0.7, =1.0.7, =0.0.1, =0.0.5, =1.1.0, =2.1.0 and more Source cves: CVE-2026-41696 Source advisory: OSV:GHSA-HC43-M36C-8V33...

cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp (1.0.2), io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.6.4, <=5.7.0) +8 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.13.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp 1.0.2 -...

com.btmatthews.atlas:atlas-mongodb (1.0.0), com.github.microon:microon-services-userdirectory (0.0) +6 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.2.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.btmatthews.atlas:atlas-mongodb 1.0.0 -...