cc.alans.netty-plus:netty-plus (1.0.0), cc.uncarbon.framework:helio-starter-rate-limit-redis (>=2.3.0, <=2.4.1) +820 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-keyvalue MAVEN version =3.4.0, =2.3.0, =2.3.0, =2.3.0, =0.0.1, =1.7.0.v3, =5.0.5, =3.2.5, =4.1.3 and more Source cves: CVE-2026-41719 Source advisory: OSV:GHSA-XG2J-3HJ6-PC24...

org.springframework.data:spring-data-redis (1.7.0.release) potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.0.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - org.springframework.data:spring-data-redis 1.7.0.release Sour...

com.cjoop:platform-core (0.0.1.release), com.cjoop:platform-security (0.0.1.release) +91 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.11.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.cjoop:platform-core 0.0.1.release -...

com.gitee.song666:upic-spring-common (1.0.0), com.github.bohrqiu.dubbo:dubbo-cache-core (>=1.0, <=1.2) +50 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.13.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.gitee.song666:upic-spring-common 1.0.0 -...

cc.alans.netty-plus:netty-plus (1.0.0), cc.uncarbon.framework:helio-starter-rate-limit-redis (>=2.3.0, <=2.4.1) +820 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-keyvalue MAVEN version =3.4.0, =2.3.0, =2.3.0, =2.3.0, =0.0.1, =1.7.0.v3, =5.0.5, =3.2.5, =4.1.3 and more Source cves: CVE-2026-41719 Source advisory: GHSA-XG2J-3HJ6-PC24...

com.github.fangyanpg:spring-boot-ratelimiter (>=0.0.1-release, <=0.3.0-release), com.github.yihukurama:tkmybatisplus (0.0.2-release) +10 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.22.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.2.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.github.fangyanpg:spring-boot-ratelimiter =0.0.1-release,...

com.epages:restdocs-api-spec-restassured (>=0.11.2, <=0.16.4), org.springframework.boot:spring-boot-docs (>=2.0.0.release, <=2.1.18.release) +1 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (>=2.0.0.release, <=2.0.5.release)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version =2.0.0.release, =0.11.2, =2.0.0.release, =2.0.0, =2.2.1 Source cves: CVE-2026-40991 Source advisory: GHSA-6RPQ-6VV2-5222...

com.epages:restdocs-api-spec-restassured (>=0.11.2, <=0.16.4), org.springframework.boot:spring-boot-docs (>=2.0.0.release, <=2.1.18.release) +1 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (>=2.0.0.release, <=2.0.5.release)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version =2.0.0.release, =0.11.2, =2.0.0.release, =2.0.0, =2.2.1 Source cves: CVE-2026-40991 Source advisory: OSV:GHSA-6RPQ-6VV2-5222...

com.epages:restdocs-api-spec-restassured (>=0.17.1, <=0.19.4), io.github.bgmsound:documentify-core (>=0.0.1, <=0.0.2) +2 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (>=3.0.0, <=3.0.3)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version =3.0.0, =0.17.1, =0.0.1, =1.0.0, =1.2.4, =1.3.9 Source cves: CVE-2026-40991 Source advisory: GHSA-6RPQ-6VV2-5222...

EUVD-2026-35885

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

com.epages:restdocs-api-spec-restassured (>=0.17.1, <=0.19.4), io.github.bgmsound:documentify-core (>=0.0.1, <=0.0.2) +2 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (>=3.0.0, <=3.0.3)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version =3.0.0, =0.17.1, =0.0.1, =1.0.0, =1.2.4, =1.3.9 Source cves: CVE-2026-40991 Source advisory: OSV:GHSA-6RPQ-6VV2-5222...

com.epages:restdocs-api-spec-webtestclient (>=0.11.2, <=0.16.4) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (2.0.4.release)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: -...

com.epages:restdocs-api-spec-webtestclient (>=0.17.1, <=0.19.4), com.jiangtj.platform:micro-test-cloud (>=0.0.6, <=0.0.10) +3 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (>=3.0.0, <=3.0.5)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version =3.0.0, =0.17.1, =0.0.6, =1.0.0, =1.3.10, =1.2.4, =1.4.1 Source cves: CVE-2026-40991 Source advisory: OSV:GHSA-6RPQ-6VV2-5222...

org.tuxdevelop:spring-batch-lightmin-documentation (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (1.1.3.release)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-restassured and may be impacted: -...

com.epages:restdocs-api-spec-webtestclient (>=0.11.2, <=0.16.4) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (2.0.4.release)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: -...

com.epages:restdocs-api-spec-webtestclient (>=0.17.1, <=0.19.4), com.jiangtj.platform:micro-test-cloud (>=0.0.6, <=0.0.10) +3 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (>=3.0.0, <=3.0.5)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version =3.0.0, =0.17.1, =0.0.6, =1.0.0, =1.3.10, =1.2.4, =1.4.1 Source cves: CVE-2026-40991 Source advisory: GHSA-6RPQ-6VV2-5222...

com.portlandwebworks:pww-commons (>=1.0, <=1.0.2), de.itsvs:cwtrpc-security (0.9.0) +12 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.0.6.release)

org.springframework.security:spring-security-web MAVEN version 3.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.portlandwebworks:pww-commons =1.0, =1.0.2 -...

org.springframework.amqp:spring-rabbit (1.5.5.release), org.springframework.boot:spring-boot-starter-amqp (1.3.4.release) potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.5.5.release)

org.springframework.amqp:spring-amqp MAVEN version 1.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.5.5.release -...

com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.8), com.trigyn:java-web-starter (>=2.2, <=2.13) +5 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=6.4.2, <=6.4.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.4.2, =2.2, =11.10.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =9.0-rc1, =1.15.0, =1.15.0, =2.4.0 Source cves: CVE-2026-41694 Source advisory: OSV:GHSA-WW38-37G9-M3Q3...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.9) +89 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=6.5.0, <=6.5.10)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.5.0, =1.0.0.ee-20260424025040, =11.14.0, =v6.3.3, =1.0.6, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.1.3 and more Source cves: CVE-2026-41694https://vulners.com/cve/CVE-2026-4...