ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.9) +89 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=6.5.0, <=6.5.10)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.5.0, =1.0.0.ee-20260424025040, =11.14.0, =v6.3.3, =1.0.6, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.1.3 and more Source cves: CVE-2026-40988https://vulners.com/cve/CVE-2026-4...

com.trigyn:java-web-starter (>=1.6.0, <=2.1), com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.9.0, <=11.9.5.ee) +22 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=6.3.1, <=6.3.6)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.3.1, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0 and more Source cves: CVE-2026-41694 Source advisory:...

com.trigyn:java-web-starter (>=1.6.0, <=2.1), com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.9.0, <=11.9.5.ee) +22 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=6.3.1, <=6.3.6)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.3.1, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0 and more Source cves: CVE-2026-40988 Source advisory:...

cn.springcloud.gray:spring-cloud-gray-server (>=a.1.1.1, <=a.2.0.0), cn.springcloud.gray:spring-cloud-gray-server-cluster-http-synchro-plugin (>=a.2.0.0.rc1, <=a.2.0.0) +171 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.23.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - cn.springcloud.gray:spring-cloud-gray-server =a.1.1.1,...

com.github.fangyanpg:spring-boot-ratelimiter (>=0.0.1-release, <=0.3.0-release), com.github.hushengte:disciples-feed (1.0.10) +53 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.22.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.fangyanpg:spring-boot-ratelimiter =0.0.1-release,...

com.anbai:ab-elasticsearch (7.0.0), com.blazebit:blaze-persistence-examples-showcase-fragments-spring-data (1.6.7) +74 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.20.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.anbai:ab-elasticsearch 7.0.0 -...

com.4dconcept.springframework.data:spring-data-marklogic (>=1.2.2.release, <=1.3.5.release), com.foreach.imageserver:imageserver-admin (5.0.0.release) +76 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.17.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.4dconcept.springframework.data:spring-data-marklogic...

at.researchstudio.sat:won-core (>=0.4, <=0.9), at.researchstudio.sat:won-cryptography (>=0.4, <=0.6) +88 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.16.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - at.researchstudio.sat:won-core =0.4, =0.4, =0.4, =0.4, =0.4,...

EUVD-2026-35900

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

io.rhiot:rhiot-cloudlet-geofencing (0.1.1), io.rhiot:rhiot-iot-cloudlet-document-default (0.1.1) +4 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.6.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.6.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - io.rhiot:rhiot-cloudlet-geofencing 0.1.1 -...

com.orange.fiware:openlpwa-iotagent (>=1.0.1, <=1.0.2), de.digitalcollections:iiif-bookshelf-webapp (>=2.2.0, <=2.3.0) +109 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.8.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.8.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.orange.fiware:openlpwa-iotagent =1.0.1, =2.2.0, =5.0.0.m1,...

com.lordofthejars:nosqlunit-mongodb (>=0.9.0, <=1.0.0), org.grails:grails-datastore-gorm-mongodb (>=3.0.2.release, <=3.1.5.release) +1 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.4.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.9.0, =3.0.2.release,...

com.eworkcloud.starter:ework-cloud-starter-mongo (>=2.1.1, <=2.2.9), com.winged-tech:wingedcare-common-mongodb (6.1.3_kc) +14 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.2.7.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.eworkcloud.starter:ework-cloud-starter-mongo =2.1.1, =1.29....

be.appify.prefab:prefab-annotation-processor (>=0.7.0, <=0.10.9), be.appify.prefab:prefab-mongodb (>=0.5.0, <=0.10.9) +123 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-mongodb MAVEN version =5.0.0, =0.7.0, =0.5.0, =0.5.0, =4.0.0.0-m2, =4.0.0.0-m2, =1.0.1, =1.0.1, =3.0.0, =4.0.0, =4.3.1, =0.0.1, =0.0.2, =0.0.2, =1.0.4 - com.mzinx:mongodb-spring-materialized-view 1.0.0 and more Source cves: CVE-2026-41717 Source advisory:...

com.epam.reportportal:commons-bugtracking (3.0.0), io.gravitee.am.gateway.handlers:gravitee-am-gateway-handlers (>=1.0.0, <=1.3.0) +13 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.9.8.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.9.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.epam.reportportal:commons-bugtracking 3.0.0 -...

org.activiti.cloud.messages:activiti-cloud-starter-messages-mongodb (7.1.0.m6), org.springframework.boot:spring-boot-starter-data-mongodb (2.1.12.release) +3 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.15.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

ai.platon.commons:distributed-lock-example (>=1.4.2, <=1.4.3), ai.platon.commons:distributed-lock-mongo (>=1.4.2, <=1.4.3) +628 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=3.0.0.release, <=3.4.18)

org.springframework.data:spring-data-mongodb MAVEN version =3.0.0.release, =1.4.2, =1.4.2, =1.6.6, =1.6.6, =0.0.1, =0.1.0, =0.1.0, =1.1.13, =1.0.7, =1.0.7, =0.0.1, =0.0.5, =1.1.0, =2.1.0 and more Source cves: CVE-2026-41717 Source advisory: OSV:GHSA-5WHC-4Q84-FJ73...

co.aurasphere.botmill:botmill-core (>=1.0.0, <=1.0.2), co.aurasphere.botmill:fb-botmill (>=2.0.0-rc1, <=2.0.0-rc3) +7 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.2.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - co.aurasphere.botmill:botmill-core =1.0.0, =2.0.0-rc1, =2.0.0,...

com.sharethis:mongomigration (1.0.0), org.resthub:resthub-mongodb (>=2.1.4, <=2.1.6) +1 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.3.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.sharethis:mongomigration 1.0.0 - org.resthub:resthub-mongod...

com.aukletapm.go:go-spring (>=1.5.0, <=1.6.0), com.epam.reportportal:commons-bugtracking (3.1.0) +11 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.aukletapm.go:go-spring =1.5.0, =0.7.18, =1.0.0, =2.0.1,...