com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.0.0.beta.ee-20220401222842, <=11.2.6.ee), io.spinnaker.gate:gate-api-tck (>=6.63.0, <=6.69.0) +8 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=5.6.2, <=5.7.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.6.2, =11.0.0.beta.ee-20220401222842, =6.63.0, =6.63.0, =6.63.0, =1.17.0, =1.17.0, =5.26.0, =5.26.0, =0.6.4-b, =0.7.0 - zone.cogni.lib.security:security 1.2.5 Source cves: CVE-2026-40988 Source advisory:...

com.btmatthews.atlas:atlas-mongodb (1.0.0), com.github.microon:microon-services-userdirectory (0.0) +18 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.5.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.5.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.btmatthews.atlas:atlas-mongodb 1.0.0 -...

org.springframework.amqp:spring-rabbit (1.6.9.release), org.springframework.amqp:spring-rabbit-test (1.6.9.release) +1 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.6.9.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.6.9.release -...

ai.hyacinth.framework:core-service-bus-support (>=0.5.0, <=0.5.24), br.com.itsme:commons (>=0.0.4-alpha, <=0.0.5-alpha) +944 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (>=2.0.0.release, <=2.4.17)

org.springframework.amqp:spring-amqp MAVEN version =2.0.0.release, =0.5.0, =0.0.4-alpha, =0.1.0.beta, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =1.2.0-release, =1.0.1, =1.0.0, =2.1.0 and more Source cves: CVE-2026-41701 Source advisory: OSV:GHSA-P5F7-RJHP-PXVC...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +481 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-relational MAVEN version =4.0.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =4.0.6.117.0, =4.0.6.117.0, =4.0.6.117.1, =0.4.7, =1.1.0 and more Source cves: CVE-2026-41697 Source advisory: OSV:GHSA-8R2H-XH92-GQ57...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-40988 Source advisory: OSV:GHSA-M69X-PW9P-7J3Q...

com.bluejeans:ipc-channel-utils (>=1.0, <=1.0.1), com.kurento.kmf:kmf-broker (4.3.1) +4 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.3.5.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.bluejeans:ipc-channel-utils =1.0, =5.0.3, =1.1.4.release, =1.1.6.release -...

EUVD-2026-35886

An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository saml2assertingpartymetadata may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials verificationcredentials and...

Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

ai.ylyue:yue-library-data-es (>=j8.2.3.0, <=j11.2.6.1), ai.ylyue:yue-library-data-jdbc (>=j8.2.3.0, <=j11.2.6.1) +531 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=2.0.0.release, <=2.4.18)

org.springframework.data:spring-data-relational MAVEN version =2.0.0.release, =j8.2.3.0, =j8.2.3.0, =0.0.1-alpha, =0.0.2-alpha, =2.5.0, =1.0.1, =2.4.5, =1.0.9, =0.0.1, =1.0.0.release, =0.1.8.jre11, =1.0.0, =1.0.0, =4.0.462, =4.0.551 and more Source cves: CVE-2026-41697 Source advisory:...

org.springframework.amqp:spring-rabbit (1.6.9.release), org.springframework.amqp:spring-rabbit-test (1.6.9.release) +1 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.6.9.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.6.9.release -...

cn.springcloud.gray:spring-cloud-gray-plugin-event-stream (>=a.1.1.1, <=a.2.0.0), cn.springcloud.gray:spring-cloud-gray-server-plugin-event-stream (>=a.1.1.1, <=a.2.0.0) +5 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.14.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cn.springcloud.gray:spring-cloud-gray-plugin-event-stream =a.1.1.1, =a.1.1.1,...

io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.4.3, <=5.5.1), org.springframework.amqp:spring-rabbit (1.7.10.release) +5 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.10.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - io.zipkin.brave:brave-instrumentation-spring-rabbit =5.4.3, =5.5.1 -...

org.springframework.amqp:spring-rabbit (1.5.4.release), org.springframework.boot:spring-boot-starter-amqp (1.3.3.release) potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.5.4.release)

org.springframework.amqp:spring-amqp MAVEN version 1.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.5.4.release -...

com.bluelock:camel-spring-amqp (>=1.5, <=1.6.1), com.nesscomputing.service.activemq:activemq-server (>=5.8.0-ness-1, <=5.8.0-ness-2) +3 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.1.4.release)

org.springframework.amqp:spring-amqp MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.bluelock:camel-spring-amqp =1.5, =5.8.0-ness-1, =2.2.2.release,...

com.ifrabbit:spring-boot-starter-data-mybatis (1.0.17.release), com.ifrabbit:spring-data-mybatis (1.0.17.release) +28 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.5.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.ifrabbit:spring-boot-starter-data-mybatis 1.0.17.release -...

org.springframework.boot:spring-boot-starter-data-elasticsearch (>=1.1.11.release, <=1.1.12.release), org.springframework.boot:spring-boot-starter-data-jpa (>=1.1.11.release, <=1.1.12.release) +22 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.8.5.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.boot:spring-boot-starter-data-elasticsearch...

com.capitalone.dashboard:api (>=3.3.0, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.5.1, <=3.7.33) +71 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.2.18.release)

org.springframework.security:spring-security-web MAVEN version 4.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.capitalone.dashboard:api =3.3.0, =3.5.1, =3.2.0,...

cn.springcloud.gray:spring-cloud-gray-plugin-event-stream (>=a.1.1.1, <=a.2.0.0), cn.springcloud.gray:spring-cloud-gray-server-plugin-event-stream (>=a.1.1.1, <=a.2.0.0) +5 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.14.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cn.springcloud.gray:spring-cloud-gray-plugin-event-stream =a.1.1.1, =a.1.1.1,...

com.bluelock:camel-spring-amqp (>=1.0, <=1.2), org.springframework.amqp:spring-rabbit (1.0.0.release) +1 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.0.0.release)

org.springframework.amqp:spring-amqp MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.bluelock:camel-spring-amqp =1.0, =2.1.0.release, =2.1.6.release Source cves...