org.springframework.data:spring-cql (1.4.9.release), org.springframework.data:spring-data-cassandra (1.4.9.release) +13 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.12.9.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.4.9.release -...

org.springframework.data:spring-cql (1.0.6.release), org.springframework.data:spring-data-cassandra (1.0.6.release) +13 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.8.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.0.6.release -...

org.springframework.data:spring-data-jpa (1.4.0.release), org.springframework.data:spring-data-mongodb (1.3.0.release) +4 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.6.0.release)

org.springframework.data:spring-data-commons MAVEN version 1.6.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-data-jpa 1.4.0.release -...

com.github.darrachequesne:spring-data-jpa-datatables (>=1.0, <=2.6), com.github.lodsve:lodsve-mongodb (>=2.4.8, <=2.5.10) +61 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.10.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.10.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.darrachequesne:spring-data-jpa-datatables =1.0,...

com.lordofthejars:nosqlunit-mongodb (>=0.9.0, <=1.0.0), org.grails:grails-datastore-gorm-mongodb (>=3.0.2.release, <=3.1.5.release) +9 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.7.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.9.0, =3.0.2.release,...

org.springframework.data:spring-cql (1.0.6.release), org.springframework.data:spring-data-cassandra (1.0.6.release) +13 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.8.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.0.6.release -...

org.springframework.boot:spring-boot-starter-data-elasticsearch (>=1.1.11.release, <=1.1.12.release), org.springframework.boot:spring-boot-starter-data-jpa (>=1.1.11.release, <=1.1.12.release) +22 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.8.5.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.boot:spring-boot-starter-data-elasticsearch...

org.springframework.data:spring-cql (1.5.21.release), org.springframework.data:spring-data-cassandra (1.5.21.release) +14 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.21.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.5.21.release -...

com.github.spt-oss:spring-boot-starter-data-jpa-plus (>=0.1.0, <=0.2.0), com.hotels:circus-train (>=11.0.0, <=16.4.0) +39 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.11.5.release)

org.springframework.data:spring-data-commons MAVEN version 1.11.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.spt-oss:spring-boot-starter-data-jpa-plus =0.1.0,...

This Week in Spring - April 7th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! It's April 7th, 2026, and I'm on the road! I started the journey for the amazing Voxxed Days Amsterdam show and am now winding my way through France. I visited Colmar, a beautiful city from which the animators on Disney's Beau...

EUVD-2019-0471

Malware in sbrugna...

EUVD-2019-0572

Malware in sbrugna...

EUVD-2022-5849

Malicious code in bioql PyPI...

com.querydsl:querydsl-collections (4.1.2), com.querydsl:querydsl-hibernate-search (4.1.2) +9 more potentially affected by CVE-2024-49203 via com.querydsl:querydsl-apt (4.1.2)

com.querydsl:querydsl-apt MAVEN version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.querydsl:querydsl-apt and may be impacted: - com.querydsl:querydsl-collections 4.1.2 - com.querydsl:querydsl-hibernate-search 4.1.2 -...

AI Meets Spring Petclinic: Implementing an AI Assistant with Spring AI (Part I)

Introduction In this two-parts blog post, I will discuss the modifications I made to Spring Petclinic to incorporate an AI assistant that allows users to interact with the application using natural language. Introduction to Spring Petclinic Spring Petclinic serves as the primary reference...

This Week in Spring - March 26th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! Sam Brannen shares some good news: a null-safe Index operator for the Spring Expression Language SpEL is coming to Spring Framework 6.2! This is interesting, and a nice application of AI do I even need to spell out "artificia...

cn.herodotus.engine:oauth2-sdk-authorization (>=2.7.0.beta4, <=2.7.0.10), cn.herodotus.engine:oauth2-sdk-authorization-server (>=2.7.0.beta4, <=2.7.0.10) +2 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.2.3)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-sdk-authorization (>=2.7.0.20, <=2.7.0.50), cn.herodotus.engine:oauth2-sdk-authorization-server (>=2.7.0.20, <=2.7.0.50) +3 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.3.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-sdk-authorization-server (2.7.0.beta3), cn.herodotus.engine:oauth2-sdk-data-jpa (2.7.0.beta3) potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.2.2)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-sdk-authentication (>=2.7.12.1, <=2.7.16.final), cn.herodotus.engine:oauth2-sdk-authentication-server (>=2.7.12.1, <=2.7.16.final) +4 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.4.3)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...