Cross-site Scripting (XSS)

Overview org.springframework.security:spring-security-saml2-service-provider is a security component for the Spring Framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the RelyingPartyRegistration function. An attacker can execute arbitrary scripts in the...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), com.eurodyn.qlack.fuse:qlack-fuse-aaa (>=3.9.8, <=3.9.9) +116 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=6.0.8, <=6.5.10)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.0.8, =1.0.0.ee-20260424025040, =3.9.8, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =1.0.6, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves:...

com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0-m1, <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0-m1, =1.52.0, =2.0.1, =4.0.0-m1, =4.0.0-m1, =4.0.0-rc1, =4.0.6 Source cves: CVE-2026-41003 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632...

Improper Certificate Validation

Overview org.springframework.amqp:spring-amqp is a package that provides support for using Spring and Java with AMQP 0.9.1, and in particular RabbitMQ. Affected versions of this package are vulnerable to Improper Certificate Validation. in the RabbitConnectionFactoryBean.setUri function when...

cloud.wondrify:grails-rabbit-amqp-plugin (7.0.0), cn.aradin:aradin-spring-actuator-starter (>=1.1.0, <=1.1.2) +510 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-rabbit (>=3.0.0, <=3.2.10)

org.springframework.amqp:spring-rabbit MAVEN version =3.0.0, =1.1.0, =1.0.0, =3.1.0.5, =3.3.0.0, =5.0.7, =2.0.0, =1.0.0-jdk21, =3.5.5, =3.5.14 and more Source cves: CVE-2026-41714 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-17308787...

cloud.wondrify:grails-rabbit-amqp-plugin (7.0.0), cn.aradin:aradin-spring-actuator-starter (>=1.1.0, <=1.1.2) +515 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (>=3.0.0, <=3.2.10)

org.springframework.amqp:spring-amqp MAVEN version =3.0.0, =1.1.0, =1.0.0, =3.1.0.5, =3.3.0.0, =5.0.7, =2.0.0, =1.0.0-jdk21, =3.5.5, =3.5.14 and more Source cves: CVE-2026-41714 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-18324541...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +99 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (>=4.0.0-m1, <=4.0.3)

org.springframework.amqp:spring-amqp MAVEN version =4.0.0-m1, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-41714 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-18324541...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +96 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-rabbit (>=4.0.0-m1, <=4.0.3)

org.springframework.amqp:spring-rabbit MAVEN version =4.0.0-m1, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-41714 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-17308787...

Allocation of Resources Without Limits or Throttling

Overview org.springframework.data:spring-data-commons is a maven plugin to centralize common resources and configuration for Spring Data Maven builds. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the property-lookup cache. An attacke...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.120.0) +9201 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (>=3.0.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.0.0, =0.1.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41716 Source advisory:...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2375 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (>=4.0.0-m1, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0-m1, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41716 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-17308778...

ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.120.0), ai.driftkit:driftkit-context-engineering-services (>=0.7.9, <=0.9.2) +689 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (>=4.0.0, <=4.5.11)

org.springframework.data:spring-data-mongodb MAVEN version =4.0.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41717 Source advisory:...

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' via parameter binding when a repository query method is annotated with @Query and uses a capture-all placeholder. An...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +464 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=4.0.0-m1, <=4.0.5)

org.springframework.data:spring-data-keyvalue MAVEN version =4.0.0-m1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =6.0.1, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m3 and more Source cves: CVE-2026-41719 Source advisory:...

Insecure Randomness

Overview Affected versions of this package are vulnerable to Insecure Randomness via the sendAndReceive function when using a fixed reply queue, due to correlation IDs being generated sequentially by an internal counter. An attacker can intercept or inject unauthorized replies by predicting...

Insecure Randomness

Overview org.springframework.amqp:spring-amqp is a package that provides support for using Spring and Java with AMQP 0.9.1, and in particular RabbitMQ. Affected versions of this package are vulnerable to Insecure Randomness. via the sendAndReceive function when using a fixed reply queue, due to...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +99 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (>=4.0.0-m1, <=4.0.3)

org.springframework.amqp:spring-amqp MAVEN version =4.0.0-m1, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-41701 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-18324292...

cloud.wondrify:grails-rabbit-amqp-plugin (7.0.0), cn.aradin:aradin-spring-actuator-starter (>=1.1.0, <=1.1.2) +510 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-rabbit (>=3.0.0, <=3.2.10)

org.springframework.amqp:spring-rabbit MAVEN version =3.0.0, =1.1.0, =1.0.0, =3.1.0.5, =3.3.0.0, =5.0.7, =2.0.0, =1.0.0-jdk21, =3.5.5, =3.5.14 and more Source cves: CVE-2026-41701 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-17308629...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +96 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-rabbit (>=4.0.0-m1, <=4.0.3)

org.springframework.amqp:spring-rabbit MAVEN version =4.0.0-m1, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-41701 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-17308629...

Open Redirect

Overview org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Open Redirect in the CookieRequestCache function. An attacker can redirect users to arbitra...