br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +82 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=4.5.0, <=4.5.11)

org.springframework.data:spring-data-rest-core MAVEN version =4.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41837 Source advisory: OSV:GHSA-MWPV-RG79-863C...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +172 more potentially affected by CVE-2026-41731 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=1.2.0, <=1.4.0), com.contentgrid.spring:contentgrid-automations-rest (>=0.15.0, <=0.17.0) +61 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (>=4.3.0, <=4.3.13)

org.springframework.data:spring-data-rest-core MAVEN version =4.3.0, =1.2.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =3.0.11, =3.0.11, =3.0.11, =2.0.0, =2.0.4 and more Source cves: CVE-2026-41729 Source advisory: GHSA-J388-8RM5-P97Fhttps://vulners.com/g...

in.clouthink.daas:daas-bm-core (>=1.0.0, <=1.0.3), in.clouthink.daas:daas-bm-mongodb (>=1.0.0, <=1.0.3) +28 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.7.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - in.clouthink.daas:daas-bm-core =1.0.0, =1.0.0, =3.0.1, =1.0.0,...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41837 Source advisory: GHSA-MWPV-RG79-86...

de.is24.common:switchman (>=1.0, <=1.3), io.fabric8.jube.images.fabric8:springboot-webmvc (>=2.0.20, <=2.0.37) +2 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.2.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - de.is24.common:switchman =1.0, =2.0.20, =1.2.0.release,...

org.springframework.data:spring-data-rest-webmvc (2.3.2.release) potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.3.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

org.springframework.data:spring-data-redis (1.8.2.release) potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.2.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.data:spring-data-redis 1.8.2.release Sour...

EUVD-2026-35901

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

com.eworkcloud:ework-cloud-starter-oss (>=1.0.3, <=1.0.9), com.eworkcloud:ework-cloud-starter-redis (>=1.0.0, <=1.8.6) +13 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.20.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.eworkcloud:ework-cloud-starter-oss =1.0.3, =1.0.0, =1.0....

com.ecfront.dew:cluster-spi-redis (1.2.2-rc), com.ecfront.dew:test-starter (1.2.2-rc) +45 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.6.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.ecfront.dew:cluster-spi-redis 1.2.2-rc -...

cn.dyaoming.common:common-cache (0.0.2), cn.ocoop.framework:shiro-spring-boot-autoconfigure (1.0.1) +42 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.4.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.dyaoming.common:common-cache 0.0.2 -...

cn.ibaijia:jsm-frame (1.3.24), com.gitee.fufu669:cache-fetch-later (>=6.6.667, <=6.666.66021) +15 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.7.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.ibaijia:jsm-frame 1.3.24 -...

com.github.binarywang:weixin-java-common (>=3.7.7.b, <=3.9.0), com.github.fangjinuo.agileway:agileway-redis (>=2.0.0, <=3.1.12) +31 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.23.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.github.binarywang:weixin-java-common =3.7.7.b, =2.0.0,...

com.nepxion:aquarius-cache-redis (>=2.0.4, <=2.0.5), com.nepxion:aquarius-cache-starter (>=2.0.4, <=2.0.5) +12 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.16.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.nepxion:aquarius-cache-redis =2.0.4, =2.0.4, =2.0.4,...

com.genxiaogu:rate-limiter-spring-boot-starter (>=1.0.0, <=2.0.1), com.github.qiujiayu:autoload-cache-spring-boot-starter (>=1.1.0, <=6.6) +10 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.5.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.genxiaogu:rate-limiter-spring-boot-starter =1.0.0, =1.1.0...

Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

com.epam.reportportal:commons-bugtracking (2.7.0), com.epam.reportportal:commons-dao (>=2.7.0, <=2.7.1.1) +41 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.3.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.epam.reportportal:commons-bugtracking 2.7.0 -...

cn.easyproject:easyshiro-redis-cache (2.6.0-release), com.acmtc:acmtc-redismq (>=1.0.0-release, <=1.0.1-release) +49 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.9.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - cn.easyproject:easyshiro-redis-cache 2.6.0-release -...

com.github.surpassm:liaoin-security-app (0.0.1.release), com.github.surpassm:liaoin-security-core (0.0.1.release) +11 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.14.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.github.surpassm:liaoin-security-app 0.0.1.release -...