com.github.lodsve:lodsve-amqp (>=2.4.8, <=2.5.7), org.springframework.amqp:spring-rabbit (1.5.3.release) +1 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.5.3.release)

org.springframework.amqp:spring-amqp MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.github.lodsve:lodsve-amqp =2.4.8, =2.5.7 -...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +98 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (>=4.0.0, <=4.0.3)

org.springframework.amqp:spring-amqp MAVEN version =4.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-41701 Source advisory: GHSA-P5F7-RJHP-PXVC...

org.springframework.amqp:spring-rabbit (1.7.15.release), org.springframework.amqp:spring-rabbit-test (1.7.15.release) potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.15.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.7.15.release -...

GHSA-4R8W-73JC-3M7Q Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can lead to an Open Redirect...

Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

org.springframework.amqp:spring-rabbit (1.3.4.release), org.springframework.boot:spring-boot-starter-amqp (>=1.1.0.release, <=1.1.3.release) +1 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.3.4.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.3.4.release -...

GHSA-6RPQ-6VV2-5222 Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

org.springframework.data:spring-data-mongodb-cross-store (2.0.3.release), org.springframework.integration:spring-integration-mongodb (5.0.1.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.0.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

GHSA-P8QJ-FJ6R-W7Q9 Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri"amqps://..." without also calling setUseSSLtrue get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1....

cn.craccd:mongohelper (>=0.1.0, <=0.2.7), cn.dev8:ktmvc (>=0.1.28, <=0.1.39) +34 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.2.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - cn.craccd:mongohelper =0.1.0, =0.1.28, =0.1.10, =2.0.0, =0.1.0,...

org.sentilo.agent:sentilo-agent-activity-monitor (1.7.0), org.sentilo.agent:sentilo-agent-alert (1.7.0) +4 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.3.5.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.sentilo.agent:sentilo-agent-activity-monitor 1.7.0 -...

com.github.kancyframework:delay-message-data-mongodb (0.0.1-release), de.adorsys.multibanking:multibanking-persistence-mongodb (>=5.4.2, <=5.5.23) +9 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.12.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.kancyframework:delay-message-data-mongodb...

com.keyholesoftware:khs-sherpa-spring (>=1.2.0, <=1.2.1), org.codehaus.spring-security-oauth:spring-security-oauth (>=3.9.ss3, <=3.11.ss3) +9 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.0.0.release)

org.springframework.security:spring-security-web MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.keyholesoftware:khs-sherpa-spring =1.2.0, =3.9.ss3,...

in.clouthink.daas:daas-token (>=1.0.0, <=1.8.1), io.github.jhipster.loaded:agent (>=0.5, <=0.12) +7 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.4.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - in.clouthink.daas:daas-token =1.0.0, =0.5, =0.5, =0.5, =0.5,...

io.tracee.binding:tracee-springrabbitmq (>=0.10.0, <=1.2.0), org.springframework.amqp:spring-rabbit (1.3.9.release) +2 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.3.9.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - io.tracee.binding:tracee-springrabbitmq =0.10.0, =1.1.11.release, =4.0.8.releas...

com.github.edgarespina:mwa-mongo (>=0.2.5, <=0.2.7), com.github.edgarespina:mwa-morphia (>=0.2.5, <=0.2.7) +18 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.0.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.edgarespina:mwa-mongo =0.2.5, =0.2.5, =0.3.0, =0.3.0...

com.trigyn:java-web-starter (>=1.6.0, <=2.1), com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.9.0, <=11.9.5.ee) +22 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=6.3.1, <=6.3.6)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.3.1, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0 and more Source cves: CVE-2026-41694 Source advisory:...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-40988 Source advisory: GHSA-M69X-PW9P-7J3Q...

com.4dconcept.springframework.data:spring-data-marklogic (>=1.2.2.release, <=1.3.5.release), com.foreach.imageserver:imageserver-admin (5.0.0.release) +76 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.17.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.4dconcept.springframework.data:spring-data-marklogic...

com.epages:restdocs-api-spec-webtestclient (>=0.11.2, <=0.16.4) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (2.0.4.release)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: -...