Denial of Service (DoS)

Overview org.springframework.data:spring-data-commons is a maven plugin to centralize common resources and configuration for Spring Data Maven builds. Affected versions of this package are vulnerable to Denial of Service DoS via the MappingContext property path resolution. An attacker can cause...

be.personify.iam:personify-api (>=1.5.0.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release) +151 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=4.0.0, <=4.5.11)

org.springframework.data:spring-data-rest-core MAVEN version =4.0.0, =1.5.0.release, =1.5.1.release, =1.5.0.release, =2.1.0.release, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41729 Source advisory:...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +29 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-webmvc (>=5.0.0-m1, <=5.0.5)

org.springframework.data:spring-data-rest-webmvc MAVEN version =5.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =2026.06 - io.github.vsvyatski:content-fs-spring-boot-starter 4.0.0 - io.github.vsvyatski:content-jpa-spring-boot-starter 4.0.0 -...

be.personify.iam:personify-api (>=1.5.0.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release) +135 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-webmvc (>=4.0.0, <=4.5.11)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.0.0, =1.5.0.release, =1.5.1.release, =1.5.0.release, =2.1.0.release, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41729 Source advisory:...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=5.0.0-m1, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41729 Source advisory: SNYK:JAVA-ORGS...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonKafkaHeaderMapper or the deprecated DefaultKafkaHeaderMapper functions. An attacker can achieve arbitrary code execution by supplying crafted header values that trigger deserialization of...

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection'. in the processing of JSON Patch requests...

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Overview org.springframework.data:spring-data-rest-webmvc is a maven plugin for Spring Data REST - WebMVC. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' in the processing of...

Information Exposure

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Information Exposure. in the error response serialization. An attacker can gain access to sensitive internal information by triggering errors that cause the full...

Information Exposure

Overview org.springframework.data:spring-data-rest-webmvc is a maven plugin for Spring Data REST - WebMVC. Affected versions of this package are vulnerable to Information Exposure in the error response serialization. An attacker can gain access to sensitive internal information by triggering erro...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (>=5.0.0-m1, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41730 Source advisory: SNYK:JAVA-ORGS...

be.personify.iam:personify-api (>=1.5.0.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release) +135 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-webmvc (>=4.0.0, <=4.5.11)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.0.0, =1.5.0.release, =1.5.1.release, =1.5.0.release, =2.1.0.release, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41730 Source advisory:...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +29 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-webmvc (>=5.0.0-m1, <=5.0.5)

org.springframework.data:spring-data-rest-webmvc MAVEN version =5.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =2026.06 - io.github.vsvyatski:content-fs-spring-boot-starter 4.0.0 - io.github.vsvyatski:content-jpa-spring-boot-starter 4.0.0 -...

Access Control Bypass

Overview org.springframework.data:spring-data-rest-webmvc is a maven plugin for Spring Data REST - WebMVC. Affected versions of this package are vulnerable to Access Control Bypass in the Querydsl integration, which accepts arbitrary persistent property paths as request-parameter filter keys...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=5.0.0-m1, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41837 Source advisory: SNYK:JAVA-ORGS...

be.personify.iam:personify-api (>=1.5.0.release, <=1.5.8.release), be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release) +135 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=4.0.0, <=4.5.11)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.0.0, =1.5.0.release, =1.5.1.release, =1.5.0.release, =2.1.0.release, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41837 Source advisory:...

Access Control Bypass

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Access Control Bypass. in the Querydsl integration, which accepts arbitrary persistent property paths as request-parameter filter keys without considering Jackson...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the retrytopic-attempts header. An attacker can manipulate retry routing and backoff behavior by sending crafted headers with out-of-range attempt counts. Remediation Upgrade...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2375 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (>=4.0.0-m1, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0-m1, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41721 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-17279540...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.120.0) +9201 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (>=3.0.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.0.0, =0.1.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41721 Source advisory:...