121 matches found
CVE-2026-47834
A flaw was found in Spring Data JPA. This vulnerability allows a remote attacker to bypass data validation mechanisms by submitting specially crafted input. This could lead to unauthorized access to limited information and minor disruptions in service availability. Mitigation There is no mitigati...
Sort Validation Bypass
org.springframework.data, spring-data-jpa is vulnerable to a Sort validation bypass. The vulnerability is due to insufficient validation of crafted Sort parameters received from untrusted sources, which allows an attacker to bypass sorting validation and potentially inject malicious sorting...
CVE-2026-47834
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...
CVE-2026-47834 Spring Data JPA Sort expression validation bypass
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...
app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0) +999 more potentially affected by CVE-2026-47834 via org.springframework.data:spring-data-jpa (>=4.0.0, <=4.0.6)
org.springframework.data:spring-data-jpa MAVEN version =4.0.0, =3.6.0, =1.0.0, =1.0.0, =1.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =6.3.0 and more Source cves: CVE-2026-47834 Source advisory: MEND:CVE-2026-47834...
CVE-2026-47834
CVE-2026-47834 affects Spring Data JPA versions 4.1.0 , 4.0.0–4.0.6 , 3.5.0–3.5.13 , and 3.0.0–3.4.15 . The vulnerability allows bypass of Sort expression validation when crafted payloads are accepted from untrusted sources, potentially leading to low confidentiality and low availability impact. ...
CVE-2026-47834 Spring Data JPA Sort expression validation bypass
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...
app.tozzi:jpa-search-helper (4.1.0), br.com.archbase:archbase-domain-driven-design (>=3.0.0, <=3.4.2) +885 more potentially affected by CVE-2026-47834 via org.springframework.data:spring-data-jpa (4.1.0)
org.springframework.data:spring-data-jpa MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-jpa and may be impacted: - app.tozzi:jpa-search-helper 4.1.0 - br.com.archbase:archbase-domain-driven-desi...
EUVD-2026-66676
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...
CVE-2026-47834
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...
CVE-2026-47834 Spring Data JPA Sort expression validation bypass
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...
PT-2026-82245
Name of the Vulnerable Software and Affected Versions Spring Data JPA version 4.1.0 Spring Data JPA versions 4.0.0 through 4.0.6 Spring Data JPA versions 3.5.0 through 3.5.13 Spring Data JPA versions 3.0.0 through 3.4.15 Description Sort validation can be bypassed when parameters containing craft...
CVE-2026-47834: Undefined Security Weakness
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...
SQL Injection
Overview org.springframework.data:spring-data-jpa is a package that is used to implement JPA based repositories. Affected versions of this package are vulnerable to SQL Injection in the validation of Sort parameters when crafted payloads are accepted from untrusted sources and used without prior...
cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass
cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass...
ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.1.0, <=3.9.3), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.1.0, <=3.9.3) +30 more potentially affected by CVE-2026-59316 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.4.0, <=1.4.8)
org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.4.0, =3.1.0, =3.1.0, =3.4.0.0, =3.4.0.0, =3.4.0.0, =3.4.0.0, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =3.4.0, =1.2.7, =1.2.6, =2.12.0, =3.1.0 and more Source cves: CVE-2026-59316 Source advisory:...
app.tozzi:jpa-search-helper (4.1.0), br.com.archbase:archbase-domain-driven-design (>=3.0.0, <=3.4.2) +885 more potentially affected by CVE-2026-47834 via org.springframework.data:spring-data-jpa (4.1.0)
org.springframework.data:spring-data-jpa MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-jpa and may be impacted: - app.tozzi:jpa-search-helper 4.1.0 - br.com.archbase:archbase-domain-driven-desi...
ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.driftkit:driftkit-context-engineering-spring-ai-starter (>=0.6.0, <=0.7.5) +4134 more potentially affected by CVE-2026-47834 via org.springframework.data:spring-data-jpa (>=3.0.0, <=4.0.6)
org.springframework.data:spring-data-jpa MAVEN version =3.0.0, =0.1.0, =0.6.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-47834 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-19267482...