com.huaweicloud.dis:huaweicloud-dis-spring-kafka (>=1.1.2, <=1.2.21), com.tencent.bk.devops.ci.common:common-kafka (>=1.3.0-rc.7-release, <=1.3.1-release-release) +3 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (1.1.8.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.huaweicloud.dis:huaweicloud-dis-spring-kafka =1.1.2, =1.3.0-rc.7-releas...

Spring Data REST has Improper Access Control in its JSON Patch Implementation

Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0...

cn.easyproject:easyshiro-redis-cache (2.6.0-release), com.acmtc:acmtc-redismq (>=1.0.0-release, <=1.0.1-release) +49 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.9.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.easyproject:easyshiro-redis-cache 2.6.0-release -...

org.springframework.data:spring-data-rest-webmvc (2.2.0.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.2.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

org.springframework.boot:spring-boot-starter-data-rest (1.5.13.release), org.springframework.data:spring-data-rest-hal-browser (2.6.12.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.12.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

com.genxiaogu:rate-limiter-spring-boot-starter (>=1.0.0, <=2.0.1), com.github.qiujiayu:autoload-cache-spring-boot-starter (>=1.1.0, <=6.6) +10 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.5.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.genxiaogu:rate-limiter-spring-boot-starter =1.0.0, =1.1.0...

com.netflix.spectator:spectator-web-spring (>=0.41.0, <=0.42.0), org.springframework.boot:spring-boot-starter-data-rest (>=1.2.7.release, <=1.2.8.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.2.4.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.netflix.spectator:spectator-web-spring =0.41.0,...

com.nepxion:aquarius-cache-redis (>=2.0.4, <=2.0.5), com.nepxion:aquarius-cache-starter (>=2.0.4, <=2.0.5) +12 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.16.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.nepxion:aquarius-cache-redis =2.0.4, =2.0.4, =2.0.4,...

com.chaoxing:redis-distribute-lock-spring-boot-starter (1.0.0), com.codingapi:sds-delivery (2.0.2) +45 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.10.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.chaoxing:redis-distribute-lock-spring-boot-starter 1.0.0...

org.springframework.data:spring-data-rest-webmvc (2.0.3.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.0.3.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

org.springframework.data:spring-data-rest-hal-browser (2.6.21.release), org.springframework.data:spring-data-rest-webmvc (2.6.21.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.21.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

org.springframework.data:spring-data-rest-webmvc (2.0.0.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.0.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

com.github.zhycn:xbird-starter-swagger2 (>=1.0.0, <=1.3.0), com.heapbrain:testdeed (>=1.2.6, <=1.3.2) +11 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.9.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.zhycn:xbird-starter-swagger2 =1.0.0, =1.2.6,...

org.springframework.data:spring-data-redis (1.7.0.release) potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.0.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.data:spring-data-redis 1.7.0.release Sour...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +455 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-keyvalue MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =6.0.1, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m3 and more Source cves: CVE-2026-41719 Source advisory:...

com.github.codinghck:utils (1.1.1-release), com.twosigma.webtau:webtau-docs (>=1.16, <=1.20) +17 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.7.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.codinghck:utils 1.1.1-release -...

com.cjoop:platform-core (0.0.1.release), com.cjoop:platform-security (0.0.1.release) +91 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.11.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.cjoop:platform-core 0.0.1.release -...

org.springframework.boot:spring-boot-starter-data-rest (1.4.5.release), org.springframework.data:spring-data-rest-hal-browser (2.5.8.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.8.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.github.paulcwarren:spring-content-rest (>=0.0.1, <=0.0.2), com.github.paulcwarren:spring-content-rest-boot-starter (>=0.0.1, <=0.0.2) +4 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.paulcwarren:spring-content-rest =0.0.1, =0.0.1,...