CVE-2026-41837 Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

MAL-2026-5466 Malicious code in getd-eslint-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17328047b2ec8dce82cfbdfd5b16c8f862d51dca26b02c9801587c220a48975a On npm install, postinstall.js collects host identifiers os.hostname, os.userInfo username, os.platform, current working directory, CI environment...

Malicious code in getd-pantallas-cliente (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89a26267435645776aa984be114d5c657e63fa9937ff044e5ddd24943b28ea6e On npm install, postinstall.js collects os.hostname, os.userInfo.username, os.platform, process.cwd, and CI/build environment variables and sends the...

Malicious code in getd-typescript-eslint-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caed4b0db34232c4ef920817b6087cee9ac0610ec4ec2e49edbb5f167342f42f On npm install, the postinstall.js script collects the installer's hostname, OS username, platform, current working directory, CI environment markers...

MAL-2026-5471 Malicious code in getd-ui-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcdbf66757b102ed524f01c498adae819b02968aa455f57316f4e08af1fb9ea0 On npm install, postinstall.js runs unconditionally scripts.postinstall = 'node postinstall.js' and sends an HTTPS GET to a hardcoded webhook.site UR...

Malicious code in getd-ui-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcdbf66757b102ed524f01c498adae819b02968aa455f57316f4e08af1fb9ea0 On npm install, postinstall.js runs unconditionally scripts.postinstall = 'node postinstall.js' and sends an HTTPS GET to a hardcoded webhook.site UR...

Malicious code in getui-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf281a31a53827497d9a24ff0602f277b568f495a00c14603c3e9bf11a30327a On npm install, postinstall.js issues an HTTPS GET to https://webhook.site/18dc4281-d366-438a-9186-76fbcd56ade5 with query parameters containing the...

Malicious code in getd-content-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44eb41541c340c710ad8afc366ab4642d3809d8d9afef53b99e3704b9dfb684b The unscoped package name 'getd-content-management' impersonates the legitimate @getd/ npm scope acknowledged in the package's own README. On npm...

MAL-2026-5465 Malicious code in getd-content-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44eb41541c340c710ad8afc366ab4642d3809d8d9afef53b99e3704b9dfb684b The unscoped package name 'getd-content-management' impersonates the legitimate @getd/ npm scope acknowledged in the package's own README. On npm...

MAL-2026-5389 Malicious code in @0xlr/stripe-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eda7bf8681a6253ffc4bc965888e45c5374e4ba8d4fe2e17efcd0f227d7ce5e On npm install, postinstall.js enumerates every entry in process.env sorted, bundles it with hostname, username, homedir, cwd, argv, and platform/arc...

MAL-2026-5397 Malicious code in create-docs-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd4381fd77419441a2eefe6b22adef6c9f5adfe1b92be5d071abd5908fdf8647 Package is published at version 9999.99.99 — the canonical high-version override used in dependency-confusion attacks against private/internal packag...

WordPress Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by PeterPatter - - in WordPress Plugin Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More versions = 1.0.15...

org.apache.camel:camel-itest-spring32 (>=2.17.0, <=2.17.7), org.springframework.integration:spring-integration-jms (3.0.8.release) potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.2.15.release)

org.springframework:spring-jms MAVEN version 3.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.camel:camel-itest-spring32 =2.17.0, =2.17.7 -...

com.assist4j:assist4j-core (>=1.0.6, <=1.0.52), com.assist4j:assist4j-data (>=1.0.6, <=1.0.52) +8 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.3.15.release)

org.springframework:spring-jms MAVEN version 4.3.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - com.assist4j:assist4j-core =1.0.6, =1.0.6, =1.0.0, =1.0.0, =1.26, =1.26, =1.27 -...

org.apache.cxf.systests:cxf-systests-uncategorized (>=3.2.8, <=3.2.9), org.springframework.boot:spring-boot-starter-activemq (1.5.19.release) +2 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.3.22.release)

org.springframework:spring-jms MAVEN version 4.3.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.cxf.systests:cxf-systests-uncategorized =3.2.8, =3.2.9 -...

org.springframework.boot:spring-boot-starter-hornetq (1.2.0.release), org.springframework.boot:spring-boot-starter-ws (1.2.0.release) +1 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.1.3.release)

org.springframework:spring-jms MAVEN version 4.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.springframework.boot:spring-boot-starter-hornetq 1.2.0.release -...

org.jadira.jms:jms (3.2.0.ga), org.springframework.integration:spring-integration-jms (4.0.0.release) potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.0.3.release)

org.springframework:spring-jms MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.jadira.jms:jms 3.2.0.ga - org.springframework.integration:spring-integration-jms...

com.3pillarglobal.labs:spring-integration-aws (2.0.0), com.auth0:spring-security-auth0 (0.2) +105 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (3.2.8.release)

org.springframework:spring-webmvc MAVEN version 3.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.3pillarglobal.labs:spring-integration-aws 2.0.0 - com.auth0:spring-security-auth0...

net.sourceforge.jfacets:jfacets-acegi (>=3.1, <=3.2.1), org.acegisecurity:acegi-security (1.0.3) +35 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (1.2.8)

org.springframework:spring-core MAVEN version 1.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - net.sourceforge.jfacets:jfacets-acegi =3.1, =1.0.2, =1.0.2, =1.0.0, =1.0.0, =1.0.2 -...

org.acegisecurity:acegi-security-tiger (1.0.0-rc1), org.apache.directory.mina:mina-integration-spring (>=0.9.1, <=0.9.5) +23 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (1.2.5)

org.springframework:spring-core MAVEN version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.acegisecurity:acegi-security-tiger 1.0.0-rc1 -...