com.alcosi.nft:nft-api-gateway (>=15.0-release, <=15.12-release), com.google.cloud:spring-cloud-gcp-starter-sql-postgres-r2dbc (>=5.5.0, <=5.13.11) +29 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-r2dbc (>=3.3.0, <=3.3.13)

org.springframework.data:spring-data-r2dbc MAVEN version =3.3.0, =15.0-release, =5.5.0, =5.5.0, =9.0.8, =9.0.8, =0.1.0, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.16 and more Source cves: CVE-2026-41697htt...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +423 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-jdbc (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-jdbc MAVEN version =4.0.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.4.7, =1.1.0 - com.codbex.atlas:codbex-atlas-application 2.110.0 - com.codbex.atlas:codbex-atlas-branding 2.110.0 - com.codbex.atlas:codbex-atlas-components-parent 2.110.0 -...

CVE-2026-41697 Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

CVE-2026-41697

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +482 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-relational MAVEN version =4.0.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =4.0.6.117.0, =4.0.6.117.0, =4.0.6.117.1, =0.4.7, =1.1.0 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

CVE-2026-41697 Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

CVE-2026-41697

CVE-2026-41697 affects Spring Data Relational/JDBC/R2DBC across multiple versions (4.0.0–4.0.5; 3.5.0–3.5.11; 3.4.0–3.4.14; 3.3.0–3.3.16; 3.2.0–3.2.15; 3.1.0–3.1.14; 3.0.0–3.0.15; 2.4.0–2.4.19). The root cause is improper escaping of binding values for StringMatcher (STARTING, ENDING, CONTAINING)...

CVE-2026-41696 Spring Data MongoDB Bind Parameter Literal Quoting Breakout

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41696 Spring Data MongoDB Bind Parameter Literal Quoting Breakout

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41696

Spring Data MongoDB CVE-2026-41696 affects multiple versions (5.0.0–5.0.5; 4.5.0–4.5.11; 4.4.0–4.4.14; 4.3.0–4.3.16; 4.2.0–4.2.15; 4.1.0–4.1.14; 4.0.0–4.0.15; 3.4.0–3.4.19). The issue is insufficient validation of bound parameters in repository query methods annotated with @Query that use regex b...

CVE-2026-41696 Spring Data MongoDB Bind Parameter Literal Quoting Breakout

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41696

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

cn.airfei.air-core:core (>=3.0.0, <=3.0.4), cn.allbs:allbs-bom (>=1.1.6, <=2.0.0) +304 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (>=3.4.0, <=3.4.18)

org.springframework.data:spring-data-mongodb MAVEN version =3.4.0, =3.0.0, =1.1.6, =1.1.6, =0.0.1, =0.0.5, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.2.3, =1.3.0 - cn.bootx.platform:service-office 1.2.3 - cn.bootx.platform:service-visualization 1.2.3 and more Source cves:...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), cn.bbwres:biscuit-mongodb-boot-starter (>=3.0.0, <=3.0.2) +251 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-mongodb MAVEN version =4.5.0, =1.0.0.ee-20260424025040, =3.0.0, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-41696 Source advisory:...

be.appify.prefab:prefab-annotation-processor (>=0.7.0, <=0.10.9), be.appify.prefab:prefab-mongodb (>=0.5.0, <=0.10.9) +123 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-mongodb MAVEN version =5.0.0, =0.7.0, =0.5.0, =0.5.0, =4.0.0.0-m2, =4.0.0.0-m2, =1.0.1, =1.0.1, =3.0.0, =4.0.0, =4.3.1, =0.0.1, =0.0.2, =0.0.2, =1.0.4 - com.mzinx:mongodb-spring-materialized-view 1.0.0 and more Source cves: CVE-2026-41696 Source advisory:...

CVE-2026-41695 Denial of Service in Spring Data Commons Property Path Resolution

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6) +3960 more potentially affected by CVE-2026-41695 via org.springframework.data:spring-data-commons (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.5.0, =0.1.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040,...

CVE-2026-41695 Denial of Service in Spring Data Commons Property Path Resolution

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through...

CVE-2026-41695

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2327 more potentially affected by CVE-2026-41695 via org.springframework.data:spring-data-commons (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41695 Source advisory: MEND:CVE-2026-41695...