ba.jamax.util:jamax-rest (>=1.3.1-release, <=1.3.4-release), com.erudika:para-server (1.13) +16 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.0.0.release)

org.springframework.security:spring-security-web MAVEN version 4.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - ba.jamax.util:jamax-rest =1.3.1-release, =2.5.2, =3.3.0...

org.springframework.data:spring-data-mongodb-cross-store (1.5.6.release), org.springframework.integration:spring-integration-mongodb (>=4.0.8.release, <=4.0.9.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.5.6.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.lordofthejars:nosqlunit-mongodb (>=0.7.5, <=0.8.1), org.inigma.shared:inigma-mongo (>=0.4, <=0.6) +3 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.1.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.7.5, =0.4, =0.2,...

cn.dyaoming.common:common-cache (0.0.2), com.github.fosin:cdp-core (1.0.0.release) +100 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.13.15.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - cn.dyaoming.common:common-cache 0.0.2 -...

Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is us...

org.springframework.amqp:spring-rabbit (1.3.8.release) potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.3.8.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.3.8.release Source cves: CVE-2026-4170...

org.springframework.amqp:spring-rabbit (1.3.7.release), org.springframework.boot:spring-boot-starter-amqp (1.1.10.release) +1 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.3.7.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.3.7.release -...

com.bq.oss.corbel:evci (1.20.0), com.bq.oss.corbel:event-bus (>=1.19.2, <=1.20.0) +10 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.4.0.release)

org.springframework.amqp:spring-amqp MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.bq.oss.corbel:evci 1.20.0 - com.bq.oss.corbel:event-bus =1.19.2, =1.19.2,...

cc.voox:publisher (0.1.2.ga), org.springframework.amqp:spring-rabbit (1.2.2.release) +2 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.2.2.release)

org.springframework.amqp:spring-amqp MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cc.voox:publisher 0.1.2.ga - org.springframework.amqp:spring-rabbit 1.2.2.relea...

com.github.dblock.waffle:waffle-spring-security3 (>=1.5, <=1.6), com.paddypowerbetfair.springframework:spring-security-saml-keys-rollover (1.0.2) +23 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.1.2.release)

org.springframework.security:spring-security-web MAVEN version 3.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.github.dblock.waffle:waffle-spring-security3 =1.5,...

cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp (1.0.2), io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.6.4, <=5.7.0) +8 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.13.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp 1.0.2 -...

com.bluelock:camel-spring-amqp (1.7.0), org.springframework.amqp:spring-rabbit (1.4.3.release) +6 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.4.3.release)

org.springframework.amqp:spring-amqp MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.bluelock:camel-spring-amqp 1.7.0 - org.springframework.amqp:spring-rabbit...

org.springframework.amqp:spring-rabbit (1.5.5.release), org.springframework.boot:spring-boot-starter-amqp (1.3.4.release) potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.5.5.release)

org.springframework.amqp:spring-amqp MAVEN version 1.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.5.5.release -...

com.github.lodsve:lodsve-amqp (>=2.4.8, <=2.5.7), org.springframework.amqp:spring-rabbit (1.5.3.release) +1 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.5.3.release)

org.springframework.amqp:spring-amqp MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.github.lodsve:lodsve-amqp =2.4.8, =2.5.7 -...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +98 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (>=4.0.0, <=4.0.3)

org.springframework.amqp:spring-amqp MAVEN version =4.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-41701 Source advisory: GHSA-P5F7-RJHP-PXVC...

org.springframework.amqp:spring-rabbit (1.7.15.release), org.springframework.amqp:spring-rabbit-test (1.7.15.release) potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.15.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.7.15.release -...

GHSA-4R8W-73JC-3M7Q Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can lead to an Open Redirect...

com.bluelock:camel-spring-amqp (>=1.0, <=1.2), org.springframework.amqp:spring-rabbit (1.0.0.release) +1 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.0.0.release)

org.springframework.amqp:spring-amqp MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.bluelock:camel-spring-amqp =1.0, =2.1.0.release, =2.1.6.release Source cves...

Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

org.springframework.amqp:spring-rabbit (1.3.4.release), org.springframework.boot:spring-boot-starter-amqp (>=1.1.0.release, <=1.1.3.release) +1 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.3.4.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.3.4.release -...