at.researchstudio.sat:won-facets (>=0.2, <=0.3), at.researchstudio.sat:won-facets-tx (>=0.2, <=0.3) +664 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.8.release)

org.springframework:spring-webmvc MAVEN version 4.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - at.researchstudio.sat:won-facets =0.2, =0.2, =0.2.7, =0.0.1-release, =0.0.3, =0.0.1,...

at.molindo:spring-data-custom (>=0.0.1, <=0.0.2), au.com.mountain-pass:hyperstate (>=1, <=3) +851 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.2.4.release)

org.springframework:spring-expression MAVEN version 4.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo:spring-data-custom =0.0.1, =1, =4.1.final, =0.0.10, =0.0.10, =0.0....

at.molindo.social:spring-social-security (1.1.0.release), cc.fozone.validation:fo-validation (>=0.9.0.release, <=0.9.1.release) +489 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (3.2.8.release)

org.springframework:spring-expression MAVEN version 3.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo.social:spring-social-security 1.1.0.release -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +166 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.0.release)

org.springframework:spring-expression MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ch.ralscha:extdirectspring (1.6.1), cn.vonce:vonce-common (>=1.0.0, <=1.0.3) +337 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.2.2.release)

org.springframework:spring-expression MAVEN version 4.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.ralscha:extdirectspring 1.6.1 - cn.vonce:vonce-common =1.0.0, =0.9.6,...

ch.codeblock.qrinvoice.rest:qrinvoice-rest-standalone (>=0.7, <=0.8), ch.rasc:sse-eventbus (1.1.6) +627 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.14.release)

org.springframework:spring-webmvc MAVEN version 4.3.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.codeblock.qrinvoice.rest:qrinvoice-rest-standalone =0.7, =0.1.6-v1, =2.0.5, =2.0....

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0) +16455 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (>=6.1.0, <=6.1.21)

org.springframework:spring-expression MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.1.0-beta.1, =0.1.0-beta.2 - ai.djl.spring:djl-spring-boot-starter-autoconfigure 0.26 - ai.djl.spring:djl-spring-boot-starter-mxnet-auto 0.26 and more Source cves:...

at.molindo:molindo-notify (>=1.0.0-alpha-3, <=2.0.0), com.blitline:blitline-image-client-example (>=0.10.1, <=0.13.3) +86 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.0.4.release)

org.springframework:spring-expression MAVEN version 4.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo:molindo-notify =1.0.0-alpha-3, =0.10.1, =0.10.1, =1.0.0, =1.0.0,...

com.github.dactiv.showcase:dactiv-base-curd (1.1.0.release), com.github.stephanarts:cas-server-integration-zeromq (>=0.0.1, <=0.0.8) +68 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (3.2.6.release)

org.springframework:spring-webmvc MAVEN version 3.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.dactiv.showcase:dactiv-base-curd 1.1.0.release -...

org.springframework:spring-hibernate (1.2.4), org.springframework:spring-orm (1.2.4) +1 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (1.2.4)

org.springframework:spring-webmvc MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework:spring-hibernate 1.2.4 - org.springframework:spring-orm 1.2.4 -...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.6), appscanstandard-integration:ibm-security-appscanstandard-scanner (>=1.0, <=2.8) +1370 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (2.5.6.sec03)

org.springframework:spring-webmvc MAVEN version 2.5.6.sec03 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - aendter.jenkins.plugins:filesystem-list-parameter-plugin =0.0.1, =1.0, =1.0, =0.0.1,...

cn.weforward:weforward-data-mysql (>=1.1.0, <=1.2.17), com.alibaba.otter:canal.client (>=1.0.25, <=1.1.0) +345 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (3.2.9.release)

org.springframework:spring-expression MAVEN version 3.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.weforward:weforward-data-mysql =1.1.0, =1.0.25, =1.0.25, =1.0.25, =1.0.25,...

cn.jairdavis:jair-common-utils (1.0.4), com.allenru:cross-origin (1.0.1) +43 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.0.2.release)

org.springframework:spring-webmvc MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.jairdavis:jair-common-utils 1.0.4 - com.allenru:cross-origin 1.0.1 -...

org.geoserver:community (1.4.0_gt2.2.x), org.geoserver:platform (>=1.4.0-m1, <=1.4.0_gt2.2.x) +6 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (1.2.5)

org.springframework:spring-webmvc MAVEN version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.geoserver:community 1.4.0gt2.2.x - org.geoserver:platform =1.4.0-m1, =1.4.0gt2.2.x -...

GHSA-R5W3-XV2F-J59Q Spring Framework Algorithmic Denial of Service via SpEL Expressions

Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or...

com.browseengine.bobo:bobo-browse (>=3.2.0, <=4.0.2), com.browseengine.bobo:bobo-solr (3.2.0) +435 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (2.5.5)

org.springframework:spring-core MAVEN version 2.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - com.browseengine.bobo:bobo-browse =3.2.0, =0.2.0, =0.0.2, =0.1.9, =0.1.3, =0.6.0, =0.7.8, =0.6.0,...

com.dtflys.forest:forest-spring (1.0.0), com.garethahealy.amq6-dual-jaas-plugin:amq6-dual-jaas-plugin-parent (>=1.2.0-beta2, <=1.4.0) +557 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.16.release)

org.springframework:spring-expression MAVEN version 3.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.dtflys.forest:forest-spring 1.0.0 -...

net.sourceforge.jsf-comp:acegi-jsf (1.1.3), net.sourceforge.openutils:openutils-usermanagement-dataobjects (2.0) +39 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (1.2.9)

org.springframework:spring-core MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - net.sourceforge.jsf-comp:acegi-jsf 1.1.3 -...

com.assist4j:assist4j-core (1.0.0), com.assist4j:assist4j-data (1.0.0) +258 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.3.13.release)

org.springframework:spring-jms MAVEN version 4.3.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - com.assist4j:assist4j-core 1.0.0 - com.assist4j:assist4j-data 1.0.0 -...

br.com.tecsinapse:glimpse-server (>=1.1.1, <=1.1.2), com.alexkasko.springjdbc.typedqueries:typed-queries-codegen (>=1.0, <=1.4.4) +89 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.0.2.release)

org.springframework:spring-expression MAVEN version 3.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.com.tecsinapse:glimpse-server =1.1.1, =1.0, =1.0, =1.0, =1.0, =1.0, =1.0.0...