io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.6.1, <=5.6.3), org.springframework.amqp:spring-rabbit (1.7.12.release) +2 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.12.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - io.zipkin.brave:brave-instrumentation-spring-rabbit =5.6.1, =5.6.3 -...

org.springframework.amqp:spring-rabbit (1.3.4.release), org.springframework.boot:spring-boot-starter-amqp (>=1.1.0.release, <=1.1.3.release) +1 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.3.4.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.3.4.release -...

com.github.aidensuen:mongodao-core (>=1.0.1, <=1.1.2), com.github.aidensuen:mongodao-pagehelper (>=1.0.3, <=1.1.2) +30 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.1.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.aidensuen:mongodao-core =1.0.1, =1.0.3, =1.0.3,...

io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.1.4, <=5.4.2), org.springframework.amqp:spring-rabbit (1.7.9.release) +2 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.9.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - io.zipkin.brave:brave-instrumentation-spring-rabbit =5.1.4, =5.4.2 -...

org.smarti18n:smarti18n-messages (>=1.0.0, <=1.0-pre7), org.springdoc:springdoc-openapi-test-app3 (3.1.1) +5 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.0.14.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.smarti18n:smarti18n-messages =1.0.0, =5.0.13.release,...

org.springframework.boot:spring-boot-starter-data-mongodb (1.5.21.release), org.springframework.data:spring-data-mongodb-cross-store (1.10.22.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.10.22.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.boot:spring-boot-starter-data-mongodb...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +90 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.2.5.release)

org.springframework.security:spring-security-web MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1,...

com.ahome-it:ahome-tooling-server-core (>=1.1.1-release, <=1.1.3-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.1-release, <=1.1.3-release) +6 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.6.0.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.1-release, =1.1.1-release,...

com.epages:restdocs-api-spec-restassured (>=0.17.1, <=0.19.4), io.github.bgmsound:documentify-core (>=0.0.1, <=0.0.2) +2 more potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-restassured (>=3.0.0, <=3.0.3)

org.springframework.restdocs:spring-restdocs-restassured MAVEN version =3.0.0, =0.17.1, =0.0.1, =1.0.0, =1.2.4, =1.3.9 Source cves: CVE-2026-40991 Source advisory: GHSA-6RPQ-6VV2-5222...

com.aerse:gcless (11.2), com.hazelcast:hazelcast-wm (>=3.4, <=3.8.3) +99 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.2.1.release)

org.springframework.security:spring-security-web MAVEN version 3.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.aerse:gcless 11.2 - com.hazelcast:hazelcast-wm =3.4...

org.springframework.data:spring-cql (1.0.6.release), org.springframework.data:spring-data-cassandra (1.0.6.release) +13 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.8.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.8.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - org.springframework.data:spring-cql 1.0.6.release -...

com.bushidowallet:bushido-address-watcher (>=1.0.0, <=1.0.1), com.bushidowallet:bushido-wallet-service (>=1.0.0, <=1.0.1) +21 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.5.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.bushidowallet:bushido-address-watcher =1.0.0, =1.0.0, =4.0....

Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring Data MongoDB 5.0.0...

cn.springcloud.gray:spring-cloud-gray-plugin-event-stream (>=a.1.1.1, <=a.2.0.0), cn.springcloud.gray:spring-cloud-gray-server-plugin-event-stream (>=a.1.1.1, <=a.2.0.0) +5 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.14.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cn.springcloud.gray:spring-cloud-gray-plugin-event-stream =a.1.1.1, =a.1.1.1,...

com.github.aidensuen:mongodao-core (>=1.0.1, <=1.1.2), com.github.aidensuen:mongodao-pagehelper (>=1.0.3, <=1.1.2) +30 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.aidensuen:mongodao-core =1.0.1, =1.0.3, =1.0.3,...

br.com.archbase:archbase-annotation-processor (>=1.0.1, <=1.0.31), br.com.archbase:archbase-app-framework (>=1.0.1, <=1.0.31) +455 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=3.0.0, <=3.3.13)

org.springframework.data:spring-data-relational MAVEN version =3.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.31 and more Source cves: CVE-2026-41697 Source advisory: GHSA-8R2H-XH92-GQ57...

EUVD-2026-35889

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0...

com.aol.microservices:micro-data (>=0.62, <=0.64), com.aol.microservices:microserver-data (>=0.60, <=0.61) +127 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.9.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.9.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.aol.microservices:micro-data =0.62, =0.60, =1.0.0,...

org.inigma.shared:inigma-mongo (>=0.6.1, <=0.10.0), org.springframework.data:spring-data-mongodb-cross-store (1.1.2.release) potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.1.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.inigma.shared:inigma-mongo =0.6.1, =0.10.0 -...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +229 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.0.3.release)

org.springframework.security:spring-security-web MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: -...