org.springframework.amqp:spring-rabbit (1.3.4.release), org.springframework.boot:spring-boot-starter-amqp (>=1.1.0.release, <=1.1.3.release) +1 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.3.4.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.3.4.release -...

com.ethlo.keyvalue:keyvalue-mysql (>=1.0.0, <=1.1.2), org.springframework.boot:spring-boot-starter-data-jdbc (2.2.0.release) +1 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.0.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - com.ethlo.keyvalue:keyvalue-mysql =1.0.0, =1.1.2 -...

EUVD-2026-35889

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0...

GHSA-6RPQ-6VV2-5222 Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

org.springframework.data:spring-data-mongodb-cross-store (2.0.3.release), org.springframework.integration:spring-integration-mongodb (5.0.1.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

GHSA-P8QJ-FJ6R-W7Q9 Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri"amqps://..." without also calling setUseSSLtrue get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1....

com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0, =1.52.0, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.6 Source cves: CVE-2026-41003 Source advisory: GHSA-3PJJ-QPW6-5FCM...

cn.craccd:mongohelper (>=0.1.0, <=0.2.7), cn.dev8:ktmvc (>=0.1.28, <=0.1.39) +34 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.2.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - cn.craccd:mongohelper =0.1.0, =0.1.28, =0.1.10, =2.0.0, =0.1.0,...

org.sentilo.agent:sentilo-agent-activity-monitor (1.7.0), org.sentilo.agent:sentilo-agent-alert (1.7.0) +4 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.3.5.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.sentilo.agent:sentilo-agent-activity-monitor 1.7.0 -...

com.github.kancyframework:delay-message-data-mongodb (0.0.1-release), de.adorsys.multibanking:multibanking-persistence-mongodb (>=5.4.2, <=5.5.23) +9 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.12.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.kancyframework:delay-message-data-mongodb...

com.keyholesoftware:khs-sherpa-spring (>=1.2.0, <=1.2.1), org.codehaus.spring-security-oauth:spring-security-oauth (>=3.9.ss3, <=3.11.ss3) +9 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.0.0.release)

org.springframework.security:spring-security-web MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.keyholesoftware:khs-sherpa-spring =1.2.0, =3.9.ss3,...

in.clouthink.daas:daas-token (>=1.0.0, <=1.8.1), io.github.jhipster.loaded:agent (>=0.5, <=0.12) +7 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.4.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - in.clouthink.daas:daas-token =1.0.0, =0.5, =0.5, =0.5, =0.5,...

io.tracee.binding:tracee-springrabbitmq (>=0.10.0, <=1.2.0), org.springframework.amqp:spring-rabbit (1.3.9.release) +2 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.3.9.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - io.tracee.binding:tracee-springrabbitmq =0.10.0, =1.1.11.release, =4.0.8.releas...

com.github.edgarespina:mwa-mongo (>=0.2.5, <=0.2.7), com.github.edgarespina:mwa-morphia (>=0.2.5, <=0.2.7) +18 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.0.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.edgarespina:mwa-mongo =0.2.5, =0.2.5, =0.3.0, =0.3.0...

com.trigyn:java-web-starter (>=1.6.0, <=2.1), com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.9.0, <=11.9.5.ee) +22 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=6.3.1, <=6.3.6)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.3.1, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0 and more Source cves: CVE-2026-41694 Source advisory:...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-40988 Source advisory: GHSA-M69X-PW9P-7J3Q...

com.4dconcept.springframework.data:spring-data-marklogic (>=1.2.2.release, <=1.3.5.release), com.foreach.imageserver:imageserver-admin (5.0.0.release) +76 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.17.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.4dconcept.springframework.data:spring-data-marklogic...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +481 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-relational MAVEN version =4.0.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =4.0.6.117.0, =4.0.6.117.0, =4.0.6.117.1, =0.4.7, =1.1.0 and more Source cves: CVE-2026-41697 Source advisory: OSV:GHSA-8R2H-XH92-GQ57...

com.epages:restdocs-api-spec-webtestclient (>=0.11.2, <=0.16.4) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (2.0.4.release)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: -...

com.epam.reportportal:commons-bugtracking (3.0.0), io.gravitee.am.gateway.handlers:gravitee-am-gateway-handlers (>=1.0.0, <=1.3.0) +13 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.9.8.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.9.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.epam.reportportal:commons-bugtracking 3.0.0 -...