com.ahome-it:ahome-tooling-server-core (>=1.1.19-release, <=1.1.31-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.23-release, <=1.1.27-release) +40 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.6.5.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.19-release, =1.1.23-release,...

org.springframework.boot:spring-boot-starter-data-mongodb (2.1.11.release), org.springframework.boot:spring-boot-starter-data-mongodb-reactive (2.1.11.release) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.14.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.boot:spring-boot-starter-data-mongodb...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.10.0, <=3.49.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.10.0, <=3.49.0) +47 more potentially affected by CVE-2026-41008 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.5.0, <=1.5.7)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.5.0, =3.10.0, =3.10.0, =1.0.0, =1.0.1, =1.0.0, =3.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-41008 Source advisory:...

com.epages:restdocs-api-spec-webtestclient (>=0.20.0, <=0.20.2) potentially affected by CVE-2026-40991 via org.springframework.restdocs:spring-restdocs-webtestclient (4.0.0)

org.springframework.restdocs:spring-restdocs-webtestclient MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.restdocs:spring-restdocs-webtestclient and may be impacted: - com.epages:restdocs-api-spec-webtestclient...

com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.8), com.trigyn:java-web-starter (>=2.2, <=2.13) +5 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=6.4.2, <=6.4.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.4.2, =2.2, =11.10.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =9.0-rc1, =1.15.0, =1.15.0, =2.4.0 Source cves: CVE-2026-41003 Source advisory: GHSA-3PJJ-QPW6-5FCM...

com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0, =1.52.0, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.6 Source cves: CVE-2026-41003 Source advisory: GHSA-3PJJ-QPW6-5FCM...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.0.0.beta.ee-20220401222842, <=11.2.6.ee), io.spinnaker.gate:gate-api-tck (>=6.63.0, <=6.69.0) +8 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=5.6.2, <=5.7.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.6.2, =11.0.0.beta.ee-20220401222842, =6.63.0, =6.63.0, =6.63.0, =1.17.0, =1.17.0, =5.26.0, =5.26.0, =0.6.4-b, =0.7.0 - zone.cogni.lib.security:security 1.2.5 Source cves: CVE-2026-41003 Source advisory:...

com.trigyn:java-web-starter (>=1.6.0, <=2.1), com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.9.0, <=11.9.5.ee) +22 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=6.3.1, <=6.3.6)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.3.1, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0 and more Source cves: CVE-2026-41003 Source advisory:...

Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters

An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10;...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-41003 Source advisory: GHSA-3PJJ-QPW6-5FCM...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.9) +89 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=6.5.0, <=6.5.10)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.5.0, =1.0.0.ee-20260424025040, =11.14.0, =v6.3.3, =1.0.6, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.1.3 and more Source cves: CVE-2026-41003https://vulners.com/cve/CVE-2026-4...

in.clouthink.daas:daas-bm-core (>=1.0.0, <=1.0.3), in.clouthink.daas:daas-bm-mongodb (>=1.0.0, <=1.0.3) +28 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.7.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.7.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - in.clouthink.daas:daas-bm-core =1.0.0, =1.0.0, =3.0.1, =1.0.0,...

africa.absa:inception-oauth2-resource-server (>=1.0.0, <=1.2.0), ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0) +6130 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (>=5.0.0.release, <=5.7.14)

org.springframework.security:spring-security-web MAVEN version =5.0.0.release, =1.0.0, =4.4.0.0, =0.1.2, =0.5.0, =j8.2.4.0, =j8.2.4.0, =0.0.2, =0.0.3, =5.3.1, =6.4.2 - au.net.causal.shoelaces:shoelaces-apphome-integration-tests-common 2.0 -...

com.github.darrachequesne:spring-data-jpa-datatables (>=1.0, <=2.6), com.github.lodsve:lodsve-mongodb (>=2.4.8, <=2.5.10) +61 more potentially affected by CVE-2026-41716 via org.springframework.data:spring-data-commons (1.10.2.release)

org.springframework.data:spring-data-commons MAVEN version 1.10.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.github.darrachequesne:spring-data-jpa-datatables =1.0,...

com.epam.reportportal:commons-bugtracking (3.0.0), com.github.haosenwei:g4m-com (1.0-releases) +64 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.12.8.release)

org.springframework.data:spring-data-commons MAVEN version 1.12.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.epam.reportportal:commons-bugtracking 3.0.0 -...

com.bluelock:camel-spring-amqp (>=1.5, <=1.6.1), com.nesscomputing.service.activemq:activemq-server (>=5.8.0-ness-1, <=5.8.0-ness-2) +3 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.1.4.release)

org.springframework.amqp:spring-amqp MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.bluelock:camel-spring-amqp =1.5, =5.8.0-ness-1, =2.2.2.release,...

com.lordofthejars:nosqlunit-mongodb (>=0.9.0, <=1.0.0), org.grails:grails-datastore-gorm-mongodb (>=3.0.2.release, <=3.1.5.release) +1 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.4.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.9.0, =3.0.2.release,...

com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.8), com.trigyn:java-web-starter (>=2.2, <=2.13) +5 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=6.4.2, <=6.4.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.4.2, =2.2, =11.10.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =9.0-rc1, =1.15.0, =1.15.0, =2.4.0 Source cves: CVE-2026-41694 Source advisory: OSV:GHSA-WW38-37G9-M3Q3...

org.springframework.security:spring-security-cas (3.1.5.release), org.springframework.security:spring-security-openid (3.1.5.release) +1 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.1.5.release)

org.springframework.security:spring-security-web MAVEN version 3.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.springframework.security:spring-security-cas...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +98 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (>=4.0.0, <=4.0.3)

org.springframework.amqp:spring-amqp MAVEN version =4.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-41714 Source advisory: OSV:GHSA-P8QJ-FJ6R-W7Q9...