gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin (>=0.0.1, <=0.0.8), org.springframework.boot:spring-boot-starter-data-rest (1.1.4.release) +5 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.14.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.14.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin...

com.clusterra:clusterra-iam-application (>=1.1.0.release, <=1.2.1.release), com.clusterra:clusterra-iam-rest (>=1.1.0.release, <=1.2.1.release) +44 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.16.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.16.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - com.clusterra:clusterra-iam-application =1.1.0.release,...

io.springfox:springfox-core (>=2.0.1, <=2.1.2), io.springfox:springfox-petstore (>=2.0.1, <=2.1.2) +9 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.17.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.17.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.springfox:springfox-core =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.0.1...

au.com.mountain-pass:hyperstate (>=1, <=9), cn.bestwu:data-rest (>=1.0.0.m1, <=1.0.0.m2) +72 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.19.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.19.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - au.com.mountain-pass:hyperstate =1, =1.0.0.m1, =1.0.0, =0.1.1,...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +72 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.20.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.20.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =1, =1, =1, =1, =1,...

am.ik.home:uaa-client (>=1.3.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.3.0, <=1.9.0) +181 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.23.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.23.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - am.ik.home:uaa-client =1.3.0, =1.3.0, =1.3.0, =1.0.1.release,...

cn.dinodev:dinodev-spring-core (>=3.3.0, <=3.3.4), com.alibaba.cloud.ai:spring-ai-alibaba-graph-studio (>=1.0.0.3, <=1.0.0.3-20260305-cve) +207 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (>=2.3.0, <=2.3.4)

org.springframework.hateoas:spring-hateoas MAVEN version =2.3.0, =3.3.0, =1.0.0.3, =3.0.0, =1.6.12, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.16.0, =0.15.0, =0.15.0, =0.15.0, =0.17.0 - com.contentgrid.thunx:spring-data-querydsl-predicate-injector 0.11.0 and more Source cves: CVE-2026-41006 Source...

be.personify.iam:personify-api (>=1.5.3.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release) +88 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (>=2.4.0, <=2.4.1)

org.springframework.hateoas:spring-hateoas MAVEN version =2.4.0, =1.5.3.release, =1.5.4.release, =1.5.4.release, =0.3.3, =0.3.2, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.18.0, =0.11.1, =0.11.1, =0.12.0 and more Source cves: CVE-2026-41006 Source advisory:...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +44 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (>=3.0.0, <=3.0.3)

org.springframework.hateoas:spring-hateoas MAVEN version =3.0.0, =0.0.1-beta, =3.0.0, =3.0.0, =1.0.0, =4.0, =4.0, =3.0.9, =3.0.9, =3.0.9, =3.0.0, =1.0.45, =1.0.81 and more Source cves: CVE-2026-41006 Source advisory: GHSA-7FXC-486F-32Q9https://vulners.com/github/GHSA-7FXC-4...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +3582 more potentially affected by CVE-2026-41710 via org.springframework.retry:spring-retry (>=2.0.0, <=2.0.12)

org.springframework.retry:spring-retry MAVEN version =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =cloud-0.1, =0.6 and more Source cves: CVE-2026-41710 Source advisory: OSV:GHSA-2827-2MXX-J8PV...

Spring Framework Escalation via Session Fixation in WebFlux

A WebFlux application with a compromised subdomain for example, compromised via cross-site scripting XSS is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0...

ch.ralscha:extdirectspring (1.7.3), cn.afterturn:easypoi-spring-boot-starter (>=0.1, <=0.1.1) +877 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (4.3.12.release)

org.springframework:spring-webmvc MAVEN version 4.3.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.ralscha:extdirectspring 1.7.3 - cn.afterturn:easypoi-spring-boot-starter =0.1,...

com.erudika:para-jar (>=1.51.2, <=1.51.4), com.erudika:para-server (>=1.51.2, <=1.54.7) +57 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=4.0.0, <=4.0.3)

org.springframework.ldap:spring-ldap-core MAVEN version =4.0.0, =1.51.2, =1.51.2, =0.2.2, =2.0.0, =2.0.0, =3.2.1, =3.2.1, =3.2.1, =2.5.0, =2.4.0, =2.4.0, =2.5.2 and more Source cves: CVE-2026-41720 Source advisory: GHSA-JRV5-8W28-4265...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.1.1, <=0.112.0) +1744 more potentially affected by CVE-2026-41843 via org.springframework:spring-webflux (>=6.1.0, <=6.1.21)

org.springframework:spring-webflux MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.6.0, =0.6.0, =0.5.0, =1.2.0, =1.1.0, =1.3.0 and more Source cves: CVE-2026-41843 Source advisory: GHSA-72PG-X5F8-J25J...

com.payneteasy.superfly:superfly-web (>=1.1-1, <=1.1-2), org.grails:grails-webflow (>=2.2.0.rc2, <=2.2.4) +9 more potentially affected by CVE-2026-41845 via org.springframework:spring-webmvc (2.5.6.sec01)

org.springframework:spring-webmvc MAVEN version 2.5.6.sec01 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.payneteasy.superfly:superfly-web =1.1-1, =2.2.0.rc2, =2.0.2, =1.0.0.release,...

com.jdroidframework:jdroid-java-webapp-core (0.10.0), com.jdroidtools:jdroid-java-webapp-core (1.0.0) +18 more potentially affected by CVE-2026-41843 via org.springframework:spring-webmvc (3.2.18.release)

org.springframework:spring-webmvc MAVEN version 3.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.jdroidframework:jdroid-java-webapp-core 0.10.0 -...

com.almis.awe:awe-annotation (>=4.11.6, <=4.12.0), com.almis.awe:awe-annotations-spring-boot-starter (>=4.11.6, <=4.12.0) +74 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=3.3.0, <=3.3.7)

org.springframework.ldap:spring-ldap-core MAVEN version =3.3.0, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =1.50.7, =1.51.1 and more Source cves: CVE-2026-41720 Source advisory: OSV:GHSA-JRV5-8W28-4265...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +2349 more potentially affected by CVE-2026-41843 via org.springframework:spring-webflux (>=6.2.0, <=6.2.18)

org.springframework:spring-webflux MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-41843 Source advisory: GHSA-72PG-X5F8-J25J...

cn.dinodev:dinodev-spring-core (>=3.3.0, <=3.3.4), com.alibaba.cloud.ai:spring-ai-alibaba-graph-studio (>=1.0.0.3, <=1.0.0.3-20260305-cve) +207 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (>=2.3.0, <=2.3.4)

org.springframework.hateoas:spring-hateoas MAVEN version =2.3.0, =3.3.0, =1.0.0.3, =3.0.0, =1.6.12, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.16.0, =0.15.0, =0.15.0, =0.15.0, =0.17.0 - com.contentgrid.thunx:spring-data-querydsl-predicate-injector 0.11.0 and more Source cves: CVE-2026-41006 Source...

com.github.kaylves:kaylves-easydao (0.0.1-release), com.github.ptomli.bedrock:bedrock-core (1.0.0) +58 more potentially affected by CVE-2026-41845 via org.springframework:spring-webmvc (3.1.4.release)

org.springframework:spring-webmvc MAVEN version 3.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.kaylves:kaylves-easydao 0.0.1-release -...