com.blitline:blitline-image-client-example (>=0.10.1, <=0.13.3), com.blitline:blitline-image-client-spring (>=0.10.1, <=0.13.3) +32 more potentially affected by CVE-2026-41844 via org.springframework:spring-webmvc (4.0.4.release)

org.springframework:spring-webmvc MAVEN version 4.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.blitline:blitline-image-client-example =0.10.1, =0.10.1, =v2.5.0-beta4, =2.4.0.rc...

com.51degrees:device-detection (>=4.4.1, <=4.4.2), com.51degrees:geo-location.web.examples.mvc (>=4.3.10, <=4.3.11) +132 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.3.30.release)

org.springframework:spring-webmvc MAVEN version 4.3.30.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.51degrees:device-detection =4.4.1, =4.3.10, =4.3.10, =4.3.14, =4.3.14, =4.3.14,...

net.sourceforge.openutils:openutils-spring (0.2) potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (2.0-m5)

org.springframework:spring-webmvc MAVEN version 2.0-m5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - net.sourceforge.openutils:openutils-spring 0.2 Source cves: CVE-2026-41841 Source advisory:...

com.consol.citrus:citrus-websocket (>=2.5, <=2.6), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=0.0.4, <=0.0.5) +11 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.2.3.release)

org.springframework:spring-websocket MAVEN version 4.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.consol.citrus:citrus-websocket =2.5, =0.0.4, =0.0.4, =0.1.3, =0.1.5, =6.2.1...

net.sf.json-lib:json-lib-ext-spring (1.0), org.apache.activemq:activemq-web (5.1.0) +9 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (2.5.1)

org.springframework:spring-webmvc MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - net.sf.json-lib:json-lib-ext-spring 1.0 - org.apache.activemq:activemq-web 5.1.0 -...

net.sf.json-lib:json-lib-ext-spring (1.0), org.apache.activemq:activemq-web (5.1.0) +9 more potentially affected by CVE-2026-41845 via org.springframework:spring-webmvc (2.5.1)

org.springframework:spring-webmvc MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - net.sf.json-lib:json-lib-ext-spring 1.0 - org.apache.activemq:activemq-web 5.1.0 -...

at.molindo.social:spring-social-config (1.1.4.release), at.molindo.social:spring-social-security (1.1.4.release) +178 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (4.1.8.release)

org.springframework:spring-webmvc MAVEN version 4.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - at.molindo.social:spring-social-config 1.1.4.release -...

com.foreach.across:across-web (3.1.2.release), com.foreach.imageserver:imageserver-admin (5.0.0.release) +156 more potentially affected by CVE-2026-41843 via org.springframework:spring-webmvc (4.3.21.release)

org.springframework:spring-webmvc MAVEN version 4.3.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.foreach.across:across-web 3.1.2.release -...

org.springframework.ws:spring-ws-core (1.0-m3) potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (2.0.2)

org.springframework:spring-webmvc MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework.ws:spring-ws-core 1.0-m3 Source cves: CVE-2026-41842 Source advisory:...

ai.platon.pulsar:browser4-rest (>=4.13.5, <=4.14.3), ai.platon.pulsar:pulsar-e2e-tests (>=4.5.0, <=4.6.0) +2815 more potentially affected by CVE-2026-41843 via org.springframework:spring-webmvc (>=7.0.0, <=7.0.7)

org.springframework:spring-webmvc MAVEN version =7.0.0, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.10.9 and more Source cves: CVE-2026-41843 Source advisory: OSV:GHSA-72PG-X5F8-J25J...

com.exadel.flamingo.maven.plugin:flamingoapp (>=1.0.0, <=1.5.0), org.acegisecurity:acegi-security (>=1.0.1, <=1.0.2) +19 more potentially affected by CVE-2026-41845 via org.springframework:spring-webmvc (1.2.7)

org.springframework:spring-webmvc MAVEN version 1.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.exadel.flamingo.maven.plugin:flamingoapp =1.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (3.0.0), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (3.0.0) +636 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.3.10.release)

org.springframework:spring-webmvc MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 3.0.0 -...

cn.jairdavis:jair-common-utils (1.0.4), com.allenru:cross-origin (1.0.1) +43 more potentially affected by CVE-2026-41844 via org.springframework:spring-webmvc (4.0.2.release)

org.springframework:spring-webmvc MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.jairdavis:jair-common-utils 1.0.4 - com.allenru:cross-origin 1.0.1 -...

at.chrl:chrl-orm-spring-integration (1.1.0), com.ahome-it:ahome-tooling-server-core (>=1.0.110-release, <=1.0.120-release) +108 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (4.2.1.release)

org.springframework:spring-webmvc MAVEN version 4.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - at.chrl:chrl-orm-spring-integration 1.1.0 - com.ahome-it:ahome-tooling-server-core...

Spring Framework Predictable Session ID in WebSocket Module

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

cn.jairdavis:jair-common-utils (1.0.4), com.allenru:cross-origin (1.0.1) +43 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (4.0.2.release)

org.springframework:spring-webmvc MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.jairdavis:jair-common-utils 1.0.4 - com.allenru:cross-origin 1.0.1 -...

africa.absa:inception-application (>=1.0.0, <=1.2.0), africa.absa:inception-test (>=1.0.0, <=1.2.0) +2979 more potentially affected by CVE-2026-41839 via org.springframework:spring-webflux (>=5.0.0.release, <=5.3.39)

org.springframework:spring-webflux MAVEN version =5.0.0.release, =1.0.0, =1.0.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =0.0.1, =v0.3.12, =v0.3.10, =v0.3.12, =2.1.2.release, =4.1.27, =4.1.7, =4.7.5 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 and more Sourc...

Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

Spring Framework Open Redirect in Spring MVC and WebFlux

A Spring MVC or Spring WebFlux application which configures a mapping for "/" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix. Affected versions: Spring Framework 7.0.0 through...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.1.1, <=0.112.0) +1744 more potentially affected by CVE-2026-41844 via org.springframework:spring-webflux (>=6.1.0, <=6.1.21)

org.springframework:spring-webflux MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.6.0, =0.6.0, =0.5.0, =1.2.0, =1.1.0, =1.3.0 and more Source cves: CVE-2026-41844 Source advisory: GHSA-H3QP-GQRC-Q736...