com.childrengreens:amqp-multi-source-spring-boot-starter (=3.0), com.i360day:spring-boot-starter-amqp-invoker (>=4.0.0 <=4.0.1) +69 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-rabbit (>=4.0.0-M1 <=4.0.3)

org.springframework.amqp:spring-rabbit MAVEN version =4.0.0-M1, =4.0.0, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =4.8.0-chi, =0.7.9, =0.7.9, =0.7.16 and more Source cves: CVE-2026-41701 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-17308629...

cn.aradin:aradin-spring-actuator-starter (>=1.1.0 <=1.1.2), cn.hdfk7.boot:hdfk7-boot-starter-common (>=1.0.0 <=3.0.3) +354 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-rabbit (>=3.0.0 <=3.2.10)

org.springframework.amqp:spring-rabbit MAVEN version =3.0.0, =1.1.0, =1.0.0, =3.1.0.5, =3.3.0.0, =1.0.0-JDK21, =0.1.0, =0.6.0, =0.6.0, =0.6.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-41701 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-17308629...

Insecure Randomness

Overview Affected versions of this package are vulnerable to Insecure Randomness via the sendAndReceive function when using a fixed reply queue, due to correlation IDs being generated sequentially by an internal counter. An attacker can intercept or inject unauthorized replies by predicting...

Insecure Randomness

Overview org.springframework.amqp:spring-amqp is a package that provides support for using Spring and Java with AMQP 0.9.1, and in particular RabbitMQ. Affected versions of this package are vulnerable to Insecure Randomness. via the sendAndReceive function when using a fixed reply queue, due to...

Open Redirect

Overview org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Open Redirect in the CookieRequestCache function. An attacker can redirect users to arbitra...

Denial of Service (DoS)

Overview org.springframework.data:spring-data-commons is a maven plugin to centralize common resources and configuration for Spring Data Maven builds. Affected versions of this package are vulnerable to Denial of Service DoS via the MappingContext property path resolution. An attacker can cause...

app.tozzi:jpa-search-helper (>=3.6.0 <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0 <=0.10.2) +2029 more potentially affected by CVE-2026-41695 via org.springframework.data:spring-data-commons (>=4.0.0 <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41695 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-17295727...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0 <=0.2.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1 <=0.120.0) +7850 more potentially affected by CVE-2026-41695 via org.springframework.data:spring-data-commons (>=3.0.0 <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.0.0, =0.1.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.8.7 and more Source cves: CVE-2026-41695 Source advisory:...

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Overview org.springframework.data:spring-data-rest-webmvc is a maven plugin for Spring Data REST - WebMVC. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' in the processing of...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonKafkaHeaderMapper or the deprecated DefaultKafkaHeaderMapper functions. An attacker can achieve arbitrary code execution by supplying crafted header values that trigger deserialization of...

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection'. in the processing of JSON Patch requests...

Information Exposure

Overview org.springframework.data:spring-data-rest-webmvc is a maven plugin for Spring Data REST - WebMVC. Affected versions of this package are vulnerable to Information Exposure in the error response serialization. An attacker can gain access to sensitive internal information by triggering erro...

Information Exposure

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Information Exposure. in the error response serialization. An attacker can gain access to sensitive internal information by triggering errors that cause the full...

be.personify.iam:personify-api (>=1.5.0.RELEASE <=1.5.7.RELEASE), be.personify.iam:personify-frontend (>=1.5.1.RELEASE <=1.5.7.RELEASE) +122 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=4.0.0 <=4.5.11)

org.springframework.data:spring-data-rest-webmvc MAVEN version =4.0.0, =1.5.0.RELEASE, =1.5.1.RELEASE, =1.5.0.RELEASE, =2.1.0.RELEASE, =1.0.1, =1.0.1, =1.0.1, =2.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =2.1.0, =2.1.18 and more Source cves: CVE-2026-41837 Source advisory:...

Access Control Bypass

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Access Control Bypass. in the Querydsl integration, which accepts arbitrary persistent property paths as request-parameter filter keys without considering Jackson...

Access Control Bypass

Overview org.springframework.data:spring-data-rest-webmvc is a maven plugin for Spring Data REST - WebMVC. Affected versions of this package are vulnerable to Access Control Bypass in the Querydsl integration, which accepts arbitrary persistent property paths as request-parameter filter keys...

com.bgiddens:spring-data-rest-utils (>=0.0.1-BETA <=0.0.7-BETA), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (=3.0.0) +29 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-webmvc (>=5.0.0-M1 <=5.0.5)

org.springframework.data:spring-data-rest-webmvc MAVEN version =5.0.0-M1, =0.0.1-BETA, =3.0.9, =3.0.9, =3.0.9, =2026.05, =2026.06 - io.github.vsvyatski:content-fs-spring-boot-starter =4.0.0 - io.github.vsvyatski:content-jpa-spring-boot-starter =4.0.0 -...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the retrytopic-attempts header. An attacker can manipulate retry routing and backoff behavior by sending crafted headers with out-of-range attempt counts. Remediation Upgrade...

Denial of Service (DoS)

Overview org.springframework.data:spring-data-commons is a maven plugin to centralize common resources and configuration for Spring Data Maven builds. Affected versions of this package are vulnerable to Denial of Service DoS via data binding. An attacker can exhaust system memory resources by...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the DelegatingDeserializer function. An attacker can exhaust system memory by sending records with unique, random spring.kafka.serialization.selector header values, leading to...