cn.dinodev:dinodev-spring-core (>=3.3.0, <=3.3.4), cn.dinodev:dinodev-spring-data (>=3.3.0, <=3.3.4) +325 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=3.3.0, <=3.3.13)

org.springframework.data:spring-data-relational MAVEN version =3.3.0, =3.3.0, =3.3.0, =15.0-release, =0.3.0, =1.5.3, =5.5.0, =5.5.0, =9.0.8, =9.0.8, =9.0.8, =9.0.8, =9.0.8, =9.0.8, =9.0.8, =9.0.8, =9.1.0 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

be.appify.prefab:prefab-annotation-processor (>=0.1.0, <=0.1.1), be.appify.prefab:prefab-core (>=0.1.0, <=0.1.1) +669 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-relational MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

cc.ddrpa.dorian.elias:elias-spring-boot-starter (>=2.5.0, <=2.5.3), cn.fantasticmao.mundo:mundo-data (>=1.0.9, <=1.0.10) +352 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=2.4.0, <=2.4.18)

org.springframework.data:spring-data-relational MAVEN version =2.4.0, =2.5.0, =1.0.9, =2.9.2.release, =0.1.8.jre11, =2.4.0, =1.5.0, =1.11.3.1, =1.12.2.0, =1.11.3.1, =1.2.0, =3.4.0, =3.4.0, =3.9.18 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via Query By Example QBE StringMatcher handling. An attacker can perform boolean-based blind data inference by supplying wildcard characters in externally controlled input used to populate a QBE probe. When...

cve-2026-41697 - MEDIUM - Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern

cve-2026-41697 - MEDIUM - Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern...

PT-2026-48313

Name of the Vulnerable Software and Affected Versions Spring Data Relational/JDBC/R2DBC versions 4.0.0 through 4.0.5 Spring Data Relational/JDBC/R2DBC versions 3.5.0 through 3.5.11 Spring Data Relational/JDBC/R2DBC versions 3.4.0 through 3.4.14 Spring Data Relational/JDBC/R2DBC versions 3.3.0...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +481 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=4.0.0-m1, <=4.0.5)

org.springframework.data:spring-data-relational MAVEN version =4.0.0-m1, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =4.0.6.117.0, =4.0.6.117.0, =4.0.6.117.1, =0.4.7, =1.1.0 and more Source cves: CVE-2026-41697 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-17307374...

be.appify.prefab:prefab-annotation-processor (>=0.1.0, <=0.1.1), be.appify.prefab:prefab-core (>=0.1.0, <=0.1.1) +977 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=3.0.0, <=3.5.11)

org.springframework.data:spring-data-relational MAVEN version =3.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41697 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-17307374...