org.activiti.cloud.messages:activiti-cloud-starter-messages-mongodb (7.1.0.m6), org.springframework.boot:spring-boot-starter-data-mongodb (2.1.12.release) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.15.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

org.springframework.data:spring-data-mongodb-cross-store (1.9.9.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.9.9.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.9.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.bol:spring-data-mongodb-encrypt (>=2.0.0, <=2.3), com.github.apavlidi:restfulqueries (0.0.1) +5 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.bol:spring-data-mongodb-encrypt =2.0.0, =2.0.6.6, =1.0.2,...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), cn.bbwres:biscuit-mongodb-boot-starter (>=3.0.0, <=3.0.2) +251 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-mongodb MAVEN version =4.5.0, =1.0.0.ee-20260424025040, =3.0.0, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-41717 Source advisory:...

GHSA-5WHC-4Q84-FJ73 Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

com.github.shoothzj:sdk-distribute-impl-mongo (3.0.27.release), de.bwaldvogel:mongo-java-server-test-common (>=1.35.0, <=1.36.0) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.2.10.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.shoothzj:sdk-distribute-impl-mongo 3.0.27.release -...

com.capitalone.dashboard:hygieia-common (>=4.0.1, <=4.1.0), com.eworkcloud.starter:ework-cloud-starter-mongo (>=2.1.7, <=2.2.2) +11 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.2.8.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.capitalone.dashboard:hygieia-common =4.0.1, =2.1.7, =1.30.0...

io.eventuate.tram.view.support:eventuate-tram-view-support-e2e-tests (>=0.3.0.release, <=0.5.0.release), io.github.daggerok:distributed-lock-mongodb (2.1.1) +30 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

org.springframework.boot:spring-boot-starter-data-mongodb (1.5.15.release), org.springframework.data:spring-data-mongodb-cross-store (1.10.14.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.10.14.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.boot:spring-boot-starter-data-mongodb...

io.eventuate.tram.view.support:eventuate-tram-view-support-e2e-tests (>=0.3.0.release, <=0.5.0.release), io.github.daggerok:distributed-lock-mongodb (2.1.1) +30 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

be.appify.prefab:prefab-annotation-processor (>=0.7.0, <=0.10.9), be.appify.prefab:prefab-mongodb (>=0.5.0, <=0.10.9) +123 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-mongodb MAVEN version =5.0.0, =0.7.0, =0.5.0, =0.5.0, =4.0.0.0-m2, =4.0.0.0-m2, =1.0.1, =1.0.1, =3.0.0, =4.0.0, =4.3.1, =0.0.1, =0.0.2, =0.0.2, =1.0.4 - com.mzinx:mongodb-spring-materialized-view 1.0.0 and more Source cves: CVE-2026-41717 Source advisory:...

ch.sahits.game:openpatriciantest (>=0.9.1-rc1, <=0.9.1), cn.minsin:mutils-data-mongodb (>=0.0.2.release, <=0.4.0.release) +14 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.5.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - ch.sahits.game:openpatriciantest =0.9.1-rc1, =0.0.2.release,...

ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.112.0), ai.driftkit:driftkit-context-engineering-services (>=0.7.9, <=0.9.2) +488 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=4.0.0, <=4.3.13)

org.springframework.data:spring-data-mongodb MAVEN version =4.0.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41717 Source advisory: OSV:GHSA-5WHC-4Q84-FJ73...

org.grails:gorm-mongodb-spring-boot (1.1.0.release), org.springframework.boot:spring-boot-starter-data-mongodb (>=1.1.0.release, <=1.1.3.release) +4 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.5.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:gorm-mongodb-spring-boot 1.1.0.release -...

org.springframework.data:spring-data-mongodb-cross-store (1.5.6.release), org.springframework.integration:spring-integration-mongodb (>=4.0.8.release, <=4.0.9.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.5.6.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

org.springframework.data:spring-data-mongodb-cross-store (2.0.3.release), org.springframework.integration:spring-integration-mongodb (5.0.1.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.efindi:smo-filter (0.0.1-release), org.springframework.data:spring-data-mongodb-cross-store (2.0.2.release) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.efindi:smo-filter 0.0.1-release -...

org.resthub:resthub-mongodb (2.1.2), org.springframework.data:spring-data-mongodb-cross-store (1.2.2.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.2.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.resthub:resthub-mongodb 2.1.2 -...

cn.dev8:ktmyoql (>=0.0.1, <=0.0.7), com.avides.springboot.testcontainer:springboot-testcontainer-mongodb (>=0.1.0-rc7, <=0.1.0-rc10) +25 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - cn.dev8:ktmyoql =0.0.1, =0.1.0-rc7, =1.0.4, =0.3.0, =0.28.0,...

com.github.lkqm:spring-data-mongodb-extends (0.1.0), io.flamingock:mongodb-springdata-v2-driver (>=0.0.10-beta, <=0.0.32-beta) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.2.13.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.lkqm:spring-data-mongodb-extends 0.1.0 -...