com.sdl.delivery:udp-service-container-core (>=11.0.0-1078, <=11.0.1-1016), org.springframework.security:spring-security-cas (4.2.16.release) +3 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.2.16.release)

org.springframework.security:spring-security-web MAVEN version 4.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.sdl.delivery:udp-service-container-core...

org.springframework.security:spring-security-cas (4.2.14.release), org.springframework.security:spring-security-openid (4.2.14.release) +2 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.2.14.release)

org.springframework.security:spring-security-web MAVEN version 4.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.springframework.security:spring-security-cas...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +172 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41730 Source advisory: GHSA-P5MM-XWGQ-WH...

org.springframework.cloud:spring-cloud-starter-stream-kafka11 (1.3.0.release), org.springframework.cloud:spring-cloud-stream-binder-kafka-0.11-test (1.3.0.release) +5 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.3.0.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.cloud:spring-cloud-starter-stream-kafka11 1.3.0.release...

org.springframework.cloud:spring-cloud-starter-stream-kafka11 (1.3.0.release), org.springframework.cloud:spring-cloud-stream-binder-kafka-0.11-test (1.3.0.release) +5 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.3.0.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.cloud:spring-cloud-starter-stream-kafka11 1.3.0.release...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41837 Source advisory: GHSA-MWPV-RG79-86...

de.bwaldvogel:mongo-java-server-test-common (1.34.0), io.holunda.taskpool:camunda-bpm-taskpool-view-mongo (>=2.0.7, <=2.1.2) +4 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.2.9.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - de.bwaldvogel:mongo-java-server-test-common 1.34.0 -...

io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.6.1, <=5.6.3), org.springframework.amqp:spring-rabbit (1.7.12.release) +2 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.12.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - io.zipkin.brave:brave-instrumentation-spring-rabbit =5.6.1, =5.6.3 -...

org.springframework.amqp:spring-rabbit (1.6.9.release), org.springframework.amqp:spring-rabbit-test (1.6.9.release) +1 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.6.9.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.6.9.release -...

org.springframework.amqp:spring-rabbit (1.6.9.release), org.springframework.amqp:spring-rabbit-test (1.6.9.release) +1 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.6.9.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.6.9.release -...

com.4dconcept.springframework.data:spring-data-marklogic (>=1.2.2.release, <=1.3.5.release), com.foreach.imageserver:imageserver-admin (5.0.0.release) +76 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.17.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.4dconcept.springframework.data:spring-data-marklogic...

com.github.shoothzj:sdk-distribute-impl-mongo (3.0.27.release), de.bwaldvogel:mongo-java-server-test-common (>=1.35.0, <=1.36.0) +3 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.2.10.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.shoothzj:sdk-distribute-impl-mongo 3.0.27.release -...

io.rhiot:rhiot-cloudlet-geofencing (0.1.1), io.rhiot:rhiot-iot-cloudlet-document-default (0.1.1) +4 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.6.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.6.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - io.rhiot:rhiot-cloudlet-geofencing 0.1.1 -...

com.github.g-chenning:jdbc-yml-quick (0.0.6-release), io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.5.2, <=5.6.0) +3 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.11.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.github.g-chenning:jdbc-yml-quick 0.0.6-release -...

org.springframework.amqp:spring-rabbit (1.7.15.release), org.springframework.amqp:spring-rabbit-test (1.7.15.release) potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.15.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.7.15.release -...

Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

com.antheminc.oss:nimbus-core (>=1.1.7, <=1.2.0), com.antheminc.oss:nimbus-entity-dsl (>=1.1.7, <=1.2.0) +84 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.2.6.release)

org.springframework.security:spring-security-web MAVEN version 4.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.antheminc.oss:nimbus-core =1.1.7, =1.1.7, =1.1.7,...

br.jus.stf.digital:core (>=0.2.0, <=1.6.0), guru.springframework:page-view-client (0.0.2) +4 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.0.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - br.jus.stf.digital:core =0.2.0, =0.0.1, =1.5.0.release, =1.5.1.release Source...

br.jus.stf.digital:core (>=0.2.0, <=1.6.0), guru.springframework:page-view-client (0.0.2) +4 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.0.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - br.jus.stf.digital:core =0.2.0, =0.0.1, =1.5.0.release, =1.5.1.release Source...