am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +71 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.1.4.release)

org.springframework.security:spring-security-web MAVEN version 4.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =3.0.1.3,...

cn.bestwu:security-oauth2-authorizationserver (1.0.1), cn.dceast.platform:platform-security-starter (2.2.3) +333 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.1.3.release)

org.springframework.security:spring-security-web MAVEN version 4.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - cn.bestwu:security-oauth2-authorizationserver 1.0.1 -...

com.antheminc.oss:nimbus-core (>=1.1.7, <=1.2.0), com.antheminc.oss:nimbus-entity-dsl (>=1.1.7, <=1.2.0) +84 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.2.6.release)

org.springframework.security:spring-security-web MAVEN version 4.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.antheminc.oss:nimbus-core =1.1.7, =1.1.7, =1.1.7,...

com.auth0:auth0-spring-security-api (>=1.3.1, <=1.4.0), com.capitalone.dashboard:hygieia-common (>=4.0.5, <=4.1.0) +29 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.2.15.release)

org.springframework.security:spring-security-web MAVEN version 4.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.auth0:auth0-spring-security-api =1.3.1, =4.0.5,...

com.antheminc.oss:nimbus-core (>=1.1.7, <=1.2.0), com.antheminc.oss:nimbus-entity-dsl (>=1.1.7, <=1.2.0) +10 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.10.12.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.antheminc.oss:nimbus-core =1.1.7, =1.1.7, =1.1.7, =1.1.7,...

EUVD-2026-35886

An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository saml2assertingpartymetadata may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials verificationcredentials and...

EUVD-2026-35885

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

EUVD-2026-35888

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can lead to an Open Redirect...

com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-40993 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0, =1.52.0, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.6 Source cves: CVE-2026-40993 Source advisory: GHSA-2Q7C-5GJM-7Q23...

com.epages:restdocs-api-spec-webtestclient (>=0.20.0, <=0.20.2) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (4.0.0)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: - com.epages:restdocs-api-spec-webtestclient...

org.tuxdevelop:spring-batch-lightmin-documentation (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (1.1.3.release)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-restassured and may be impacted: -...

com.epages:restdocs-api-spec-restassured (>=0.11.2, <=0.16.4), org.springframework.boot:spring-boot-docs (>=2.0.0.release, <=2.1.18.release) +1 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (>=2.0.0.release, <=2.0.5.release)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version =2.0.0.release, =0.11.2, =2.0.0.release, =2.0.0, =2.2.1 Source cves: CVE-2026-40991 Source advisory: OSV:GHSA-6RPQ-6VV2-5222...

com.epages:restdocs-api-spec-restassured (>=0.11.2, <=0.16.4), org.springframework.boot:spring-boot-docs (>=2.0.0.release, <=2.1.18.release) +1 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (>=2.0.0.release, <=2.0.5.release)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version =2.0.0.release, =0.11.2, =2.0.0.release, =2.0.0, =2.2.1 Source cves: CVE-2026-40991 Source advisory: GHSA-6RPQ-6VV2-5222...

com.epages:restdocs-api-spec-webtestclient (>=0.11.2, <=0.16.4) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (2.0.4.release)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: -...

com.epages:restdocs-api-spec-webtestclient (>=0.11.2, <=0.16.4) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (2.0.4.release)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: -...

com.epages:restdocs-api-spec-webtestclient (>=0.17.1, <=0.19.4), com.jiangtj.platform:micro-test-cloud (>=0.0.6, <=0.0.10) +3 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (>=3.0.0, <=3.0.5)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version =3.0.0, =0.17.1, =0.0.6, =1.0.0, =1.3.10, =1.2.4, =1.4.1 Source cves: CVE-2026-40991 Source advisory: OSV:GHSA-6RPQ-6VV2-5222...

com.epages:restdocs-api-spec-restassured (>=0.17.1, <=0.19.4), io.github.bgmsound:documentify-core (>=0.0.1, <=0.0.2) +2 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (>=3.0.0, <=3.0.3)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version =3.0.0, =0.17.1, =0.0.1, =1.0.0, =1.2.4, =1.3.9 Source cves: CVE-2026-40991 Source advisory: OSV:GHSA-6RPQ-6VV2-5222...

com.epages:restdocs-api-spec-restassured (>=0.17.1, <=0.19.4), io.github.bgmsound:documentify-core (>=0.0.1, <=0.0.2) +2 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (>=3.0.0, <=3.0.3)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version =3.0.0, =0.17.1, =0.0.1, =1.0.0, =1.2.4, =1.3.9 Source cves: CVE-2026-40991 Source advisory: GHSA-6RPQ-6VV2-5222...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=4.0.0-alpha-springboot4, <=5.2.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=4.0.0-alpha-springboot4, <=5.2.0) +66 more potentially affected by CVE-2026-41008 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =3.6.0, =3.5.0, =5.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =2.0.1 -...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.10.0, <=3.49.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.10.0, <=3.49.0) +47 more potentially affected by CVE-2026-41008 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.5.0, <=1.5.7)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.5.0, =3.10.0, =3.10.0, =1.0.0, =1.0.1, =1.0.0, =3.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-41008 Source advisory:...