ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), cn.ymotel:largedatabtach (>=1.0.1, <=1.0.4) +630 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.20.release)

org.springframework:spring-expression MAVEN version 4.3.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter 0.1.8 -...

cn.wizzer.app:wk-common (>=5.1.5, <=5.2.8-zookeeper), cn.wizzer.app:wk-nb-service-cms (>=5.1.5, <=5.2.8-zookeeper) +347 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.21.release)

org.springframework:spring-expression MAVEN version 4.3.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.wizzer.app:wk-common =5.1.5, =5.1.5, =5.1.5, =5.1.5, =5.1.5, =5.1.5,...

br.com.ideotech:draw-out-spring-boot-aop (>=1.5.19.release, <=1.5.19-4.release), br.com.ideotech:draw-out-spring-boot-lib (>=1.5.19.release, <=1.5.19-4.release) +796 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.22.release)

org.springframework:spring-expression MAVEN version 4.3.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.com.ideotech:draw-out-spring-boot-aop =1.5.19.release, =1.5.19.release,...

be.personify.iam:personify-api (>=1.0.2.release, <=1.0.8.release), club.trandiscuss:api-doc-gen (0.1) +807 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.25.release)

org.springframework:spring-expression MAVEN version 4.3.25.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - be.personify.iam:personify-api =1.0.2.release, =2.2.1zzlh, =2.2.1zzlh, =1.4....

com.github.dalet-oss:mongobee (>=1.0.1, <=1.0.4), com.github.mjeanroy:springmvc-mustache (>=0.6.0, <=1.0.0) +146 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.27.release)

org.springframework:spring-expression MAVEN version 4.3.27.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.dalet-oss:mongobee =1.0.1, =0.6.0, =0.10.0, =0.10.0, =0.10.0,...

com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate (>=2.3.12, <=2.3.20), com.github.fangjinuo.audit:audit-spring (>=2.3.12, <=2.3.20) +129 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.29.release)

org.springframework:spring-expression MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate...

cn.zzq0324:feature-flag (>=1.0.1, <=1.0.2), com.51degrees:device-detection (>=4.4.1, <=4.4.2) +552 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.30.release)

org.springframework:spring-expression MAVEN version 4.3.30.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.zzq0324:feature-flag =1.0.1, =4.4.1, =4.3.10, =4.3.10, =4.3.14, =4.3.14,...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +11358 more potentially affected by CVE-2026-41854 via org.springframework:spring-web (>=6.2.0, <=6.2.18)

org.springframework:spring-web MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.29 and more Source cves: CVE-2026-41854 Source advisory: GHSA-7M2P-62GW-P8QQ...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +11358 more potentially affected by CVE-2026-41854 via org.springframework:spring-web (>=6.2.0, <=6.2.18)

org.springframework:spring-web MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.29 and more Source cves: CVE-2026-41854 Source advisory: OSV:GHSA-7M2P-62GW-P8QQ...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-cli_3 (>=0.3.0, <=0.5.7) +4803 more potentially affected by CVE-2026-41854 via org.springframework:spring-web (>=7.0.0, <=7.0.7)

org.springframework:spring-web MAVEN version =7.0.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.1.0 and more Source cves: CVE-2026-41854 Source advisory: GHSA-7M2P-62GW-P8QQ...

org.springframework:spring-hibernate (1.2.4), org.springframework:spring-orm (1.2.4) +1 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (1.2.4)

org.springframework:spring-webmvc MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework:spring-hibernate 1.2.4 - org.springframework:spring-orm 1.2.4 -...

org.springframework:spring-hibernate (1.2.2), org.springframework:spring-orm (1.2.2) +1 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (1.2.2)

org.springframework:spring-webmvc MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework:spring-hibernate 1.2.2 - org.springframework:spring-orm 1.2.2 -...

net.sourceforge.openutils:openutils-bshd5 (0.1), net.sourceforge.openutils:openutils-spring (0.1) +11 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (1.2.6)

org.springframework:spring-webmvc MAVEN version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - net.sourceforge.openutils:openutils-bshd5 0.1 - net.sourceforge.openutils:openutils-spring 0....

org.springframework:spring-hibernate (1.2.4), org.springframework:spring-orm (1.2.4) +1 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (1.2.4)

org.springframework:spring-webmvc MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework:spring-hibernate 1.2.4 - org.springframework:spring-orm 1.2.4 -...

org.springframework:spring-hibernate (1.2.1), org.springframework:spring-orm (1.2.1) +1 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (1.2.1)

org.springframework:spring-webmvc MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework:spring-hibernate 1.2.1 - org.springframework:spring-orm 1.2.1 -...

net.sourceforge.openutils:openutils-bshd5 (0.1), net.sourceforge.openutils:openutils-spring (0.1) +11 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (1.2.6)

org.springframework:spring-webmvc MAVEN version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - net.sourceforge.openutils:openutils-bshd5 0.1 - net.sourceforge.openutils:openutils-spring 0....

org.springframework:spring-hibernate (1.2.1), org.springframework:spring-orm (1.2.1) +1 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (1.2.1)

org.springframework:spring-webmvc MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework:spring-hibernate 1.2.1 - org.springframework:spring-orm 1.2.1 -...

org.springframework:spring-hibernate (1.2.3), org.springframework:spring-orm (1.2.3) +1 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (1.2.3)

org.springframework:spring-webmvc MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework:spring-hibernate 1.2.3 - org.springframework:spring-orm 1.2.3 -...

org.apache.camel:camel-itest-spring40 (>=2.15.2, <=2.17.7), org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-ws-support (>=2.2.1.release_1, <=2.3.0.release_1) +5 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.0.9.release)

org.springframework:spring-jms MAVEN version 4.0.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.camel:camel-itest-spring40 =2.15.2, =2.2.1.release1, =1.0.0, =1.1.11.release,...

GHSA-7M2P-62GW-P8QQ Spring Framework Server-Side Request Forgery via UriComponentsBuilder

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery SSRF attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18...