org.grails:grails-datastore-gorm-mongo (>=1.0.0.rc5, <=1.0.0.release), org.grails:grails-datastore-mongo (>=1.0.0.rc5, <=1.0.0.release) +2 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.0.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:grails-datastore-gorm-mongo =1.0.0.rc5, =1.0.0.rc5,...

com.lordofthejars:nosqlunit-mongodb (>=0.7.5, <=0.8.1), org.inigma.shared:inigma-mongo (>=0.4, <=0.6) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.1.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.7.5, =0.4, =0.2,...

org.grails:gorm-mongodb-spring-boot (1.1.0.release), org.springframework.boot:spring-boot-starter-data-mongodb (>=1.1.0.release, <=1.1.3.release) +4 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.5.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:gorm-mongodb-spring-boot 1.1.0.release -...

org.craftercms:crafter-social (2.3.6), org.grails:gorm-mongodb-spring-boot (>=1.0.0.rc2, <=1.0.0.release) +7 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.4.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.craftercms:crafter-social 2.3.6 -...

org.springframework.data:spring-data-mongodb-cross-store (1.5.6.release), org.springframework.integration:spring-integration-mongodb (>=4.0.8.release, <=4.0.9.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.5.6.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.alibaba.smart.framework:smart-engine-extension-storage-mongodb (>=2.0.4, <=2.6.4), org.springframework.boot:spring-boot-starter-data-mongodb (1.4.7.release) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.9.11.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.9.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

org.springframework.boot:spring-boot-starter-data-mongodb (2.1.15.release), org.springframework.boot:spring-boot-starter-data-mongodb-reactive (2.1.15.release) +2 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.18.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.boot:spring-boot-starter-data-mongodb...

de.adorsys.multibanking:multibanking-persistence-mongodb (>=5.5.26, <=5.5.43), de.adorsys.multibanking:multibanking-server (>=5.5.26, <=5.5.43) +7 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.21.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - de.adorsys.multibanking:multibanking-persistence-mongodb...

org.springframework.amqp:spring-rabbit (1.3.2.release), org.springframework.integration:spring-integration-amqp (4.0.0.release) potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.3.2.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.3.2.release -...

com.bushidowallet:bushido-address-watcher (>=1.0.0, <=1.0.1), com.bushidowallet:bushido-wallet-service (>=1.0.0, <=1.0.1) +3 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.3.6.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.bushidowallet:bushido-address-watcher =1.0.0, =1.0.0, =1.1.7.release,...

Directory Traversal

Overview org.springframework.integration:spring-integration-file is a Spring Integration File Support Affected versions of this package are vulnerable to Directory Traversal via improper validation of file paths received from FTP, SFTP, or SMB servers. A malicious or compromised server can write...

org.springframework.integration:spring-integration-ftp (>=7.1.0-m1, <=7.1.0-rc1), org.springframework.integration:spring-integration-sftp (>=7.1.0-m1, <=7.1.0-rc1) +2 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=7.1.0-m1, <=7.1.0-rc1)

org.springframework.integration:spring-integration-file MAVEN version =7.1.0-m1, =7.1.0-m1, =7.1.0-m1, =7.1.0-m1, =7.1.0-m1, =7.1.0-rc1 Source cves: CVE-2026-40987 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-17308053...

Directory Traversal

Overview org.springframework.integration:spring-integration-ftp is a Affected versions of this package are vulnerable to Directory Traversal. via improper validation of file paths received from FTP, SFTP, or SMB servers. A malicious or compromised server can write arbitrary files outside the...

cve-2026-40987 - HIGH - Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

cve-2026-40987 - HIGH - Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization...

io.awspring.cloud:spring-cloud-aws-starter-integration-s3 (>=4.0.0-m1, <=4.0.2), org.eclipse.dirigible:dirigible-components-engine-ftp (>=12.94.0, <=13.5.0) +18 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=7.0.0-m1, <=7.0.4)

org.springframework.integration:spring-integration-file MAVEN version =7.0.0-m1, =4.0.0-m1, =12.94.0, =13.5.0 - org.springframework.cloud.fn:spring-aws-s3-common 6.0.0 - org.springframework.cloud.fn:spring-file-common 6.0.0 - org.springframework.cloud.fn:spring-file-consumer 6.0.0 -...

org.eclipse.dirigible:dirigible-components-engine-ftp (>=12.94.0, <=13.5.0), org.springframework.cloud.fn:spring-ftp-common (6.0.0) +2 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-ftp (7.0.4)

org.springframework.integration:spring-integration-ftp MAVEN version 7.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ftp and may be impacted: - org.eclipse.dirigible:dirigible-components-engine-f...

ca.jeb:common-java (2014.10.01), ca.jeb:protobuf-serializer (2014.10.01) +3 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.0.7.release)

org.springframework:spring-jms MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - ca.jeb:common-java 2014.10.01 - ca.jeb:protobuf-serializer 2014.10.01 -...

org.jadira.jms:jms (3.2.0.ga), org.springframework.integration:spring-integration-jms (4.0.0.release) potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.0.3.release)

org.springframework:spring-jms MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.jadira.jms:jms 3.2.0.ga - org.springframework.integration:spring-integration-jms...

org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-ws-support (>=2.4.2.release_1, <=2.4.2.release_2), org.springframework.integration:spring-integration-jms (4.2.13.release) +1 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.2.9.release)

org.springframework:spring-jms MAVEN version 4.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-ws-support...

org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-ws-support (>=2.2.0.release_1, <=2.2.0.release_2), org.chtijbug.drools:drools-platform-brms (>=0.5.0, <=0.5.5) +4 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.0.5.release)

org.springframework:spring-jms MAVEN version 4.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-ws-support...