ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0) +16408 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (>=6.1.0, <=6.1.21)

org.springframework:spring-expression MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.1.0-beta.1, =0.1.0-beta.2 - ai.djl.spring:djl-spring-boot-starter-autoconfigure 0.26 - ai.djl.spring:djl-spring-boot-starter-mxnet-auto 0.26 and more Source cves:...

cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2), cc.ecore:spring-jfinal-plus (>=0.1.1, <=0.1.2) +200 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (3.2.0.release)

org.springframework:spring-core MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1, =0.4.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1,...

ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), cn.ymotel:largedatabtach (>=1.0.1, <=1.0.4) +705 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.3.20.release)

org.springframework:spring-core MAVEN version 4.3.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter 0.1.8 - cn.ymotel:largedatabtach...

com.exadel.flamingo.maven.plugin:flamingoapp (>=1.0.0, <=1.5.0), org.acegisecurity:acegi-security (>=1.0.1, <=1.0.2) +19 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (1.2.7)

org.springframework:spring-webmvc MAVEN version 1.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.exadel.flamingo.maven.plugin:flamingoapp =1.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1,...

ca.grimoire:mainspring (>=1.0, <=1.0.4), ch.abertschi.arquillian:arquillian-extension-aspectj (>=0.0.1-alpha1, <=0.0.1-alpha5) +1386 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (2.5.6)

org.springframework:spring-core MAVEN version 2.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ca.grimoire:mainspring =1.0, =0.0.1-alpha1, =2.1.0, =1.2.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =1.0....

ch.rasc:sse-eventbus (1.1.9), com.atlassian.oai:swagger-request-validator-examples (>=2.9.1, <=2.13.0) +479 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.26.release)

org.springframework:spring-expression MAVEN version 4.3.26.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.rasc:sse-eventbus 1.1.9 -...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.6), ai.fastllm:agent-cli_3 (>=0.3.0, <=0.5.6) +8670 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (>=7.0.0, <=7.0.7)

org.springframework:spring-expression MAVEN version =7.0.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-41852 Source advisory: OSV:GHSA-9F52-RJQV-25QV...

ch.ralscha:extdirectspring (1.6.1), com.aggrepoint.framework:winlet (>=0.1.6, <=0.1.17) +72 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (4.2.2.release)

org.springframework:spring-webmvc MAVEN version 4.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.ralscha:extdirectspring 1.6.1 - com.aggrepoint.framework:winlet =0.1.6, =1.0.0-rc3...

cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2), cc.ecore:spring-jfinal-plus (>=0.1.1, <=0.1.2) +175 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (3.2.0.release)

org.springframework:spring-expression MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1, =0.4.0, =0.0.1, =0.0.1, =0.0.1,...

at.porscheinformatik.zanata:zanata-spring (>=1.0.0.release, <=1.1.0.release), ca.appsimulations:jlqninterface (>=1.0.0, <=1.1.0) +1586 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.13.release)

org.springframework:spring-expression MAVEN version 4.3.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.porscheinformatik.zanata:zanata-spring =1.0.0.release, =1.0.0, =1.0.2,...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +19086 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (>=6.2.0, <=6.2.18)

org.springframework:spring-expression MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =0.9.0 and more Source cves: CVE-2026-41850 Source advisory: OSV:GHSA-R5W3-XV2F-J59Q...

com.gwtincubator:gwt-incubator-security (1.0.1), com.redhat.rhevm.api:rhevm-api-mock-webapp (>=0.1-milestone, <=0.9-milestone8.2) +200 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (2.5.6)

org.springframework:spring-webmvc MAVEN version 2.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.gwtincubator:gwt-incubator-security 1.0.1 - com.redhat.rhevm.api:rhevm-api-mock-webapp...

ca.islandora.alpaca:islandora-connector-broadcast (>=0.2.0, <=0.3.0), ca.islandora.alpaca:islandora-indexing-triplestore (0.1.0) +115 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.1.9.release)

org.springframework:spring-jms MAVEN version 4.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - ca.islandora.alpaca:islandora-connector-broadcast =0.2.0, =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc...

cn.smilevers:xxljob-spring-boot-starter (1.8.2-release), com.alibaba.csb.sdk:java (1.1.5.11) +153 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (3.2.18.release)

org.springframework:spring-expression MAVEN version 3.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.smilevers:xxljob-spring-boot-starter 1.8.2-release -...

at.molindo:spring-data-custom (1.0.0), at.researchstudio.sat:won-core (>=0.2, <=0.3) +1539 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.3.8.release)

org.springframework:spring-core MAVEN version 4.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - at.molindo:spring-data-custom 1.0.0 - at.researchstudio.sat:won-core =0.2, =0.2, =0.2,...

be.rufer.swisscom.sms:api-client (1.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (0.9) +233 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.1.3.release)

org.springframework:spring-expression MAVEN version 4.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - be.rufer.swisscom.sms:api-client 1.0 -...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +11312 more potentially affected by CVE-2026-41854 via org.springframework:spring-web (>=6.2.0, <=6.2.18)

org.springframework:spring-web MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.29 and more Source cves: CVE-2026-41854 Source advisory: OSV:GHSA-7M2P-62GW-P8QQ...

ch.sbb.releasetrain:action (0.0.25), ch.sbb.releasetrain:config (0.0.25) +675 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.2.7.release)

org.springframework:spring-core MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ch.sbb.releasetrain:action 0.0.25 - ch.sbb.releasetrain:config 0.0.25 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +348 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.1.release)

org.springframework:spring-expression MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release,...

cn.chenzw.swagger:swagger-ext-all (1.0.1), cn.chenzw.swagger:swagger-ext-core (1.0.1) +216 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.24.release)

org.springframework:spring-webmvc MAVEN version 4.3.24.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.chenzw.swagger:swagger-ext-all 1.0.1 - cn.chenzw.swagger:swagger-ext-core 1.0.1 -...