Access Control Bypass

Overview org.springframework.data:spring-data-rest-webmvc is a maven plugin for Spring Data REST - WebMVC. Affected versions of this package are vulnerable to Access Control Bypass in the Querydsl integration, which accepts arbitrary persistent property paths as request-parameter filter keys...

org.springframework.data:spring-data-rest-hal-browser (2.4.0.release), org.springframework.data:spring-data-rest-webmvc (2.4.0.release) potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.4.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

io.fabric8.jube.images.fabric8:springboot-webmvc (>=2.2.7, <=2.2.28), org.springframework.boot:spring-boot-starter-data-rest (>=1.2.5.release, <=1.2.6.release) +2 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.2.3.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8.jube.images.fabric8:springboot-webmvc =2.2.7,...

org.springframework.data:spring-data-rest-hal-browser (2.5.0.release), org.springframework.data:spring-data-rest-webmvc (2.5.0.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.5.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

org.springframework.data:spring-data-rest-webmvc (2.1.6.release) potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.1.6.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

org.springframework.boot:spring-boot-starter-data-rest (1.4.7.release), org.springframework.data:spring-data-rest-hal-browser (2.5.11.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.5.11.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.5.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.ixortalk:ixortalk-authorization-server (>=0.0.1, <=0.0.6), org.springframework.boot:spring-boot-starter-data-rest (1.5.21.release) +2 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.22.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.ixortalk:ixortalk-authorization-server =0.0.1, =0.0.6 ...

am.ik.home:uaa-server (>=1.3.0, <=1.8.1), br.com.intelipost:sdk-java (>=0.0.1, <=0.0.8) +4 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - am.ik.home:uaa-server =1.3.0, =0.0.1, =1.5.0.release,...

io.fabric8:process-spring-boot-itests-service-invoicing (>=1.2.0.beta2, <=1.2.0.beta3), org.springframework.boot:spring-boot-starter-data-rest (1.1.5.release) +1 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.1.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8:process-spring-boot-itests-service-invoicing...

am.ik.home:uaa-server (1.9.0), com.github.ddewaele:springboot.crud.sample (0.0.10) +3 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.6.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - am.ik.home:uaa-server 1.9.0 -...

org.springframework.boot:spring-boot-starter-data-rest (1.5.18.release), org.springframework.data:spring-data-rest-hal-browser (2.6.17.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.6.17.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.springframework.boot:spring-boot-starter-data-rest (1.3.8.release), org.springframework.data:spring-data-rest-hal-browser (2.4.5.release) +1 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.4.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.springframework.boot:spring-boot-starter-data-rest (>=1.5.11.release, <=1.5.12.release), org.springframework.data:spring-data-rest-hal-browser (2.6.11.release) +1 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.11.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.appverse.web.framework.modules.backend.frontfacade.mvc.schema:appverse-web-modules-backend-frontfacade-mvc-schema (2.0.0-rc4), org.springframework.boot:spring-boot-starter-data-rest (1.3.0.release) +2 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.4.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: -...

com.github.paulcwarren:content-rest-spring-boot-starter (>=0.0.9, <=0.0.11), com.github.paulcwarren:spring-content-rest (>=0.0.9, <=0.0.11) +7 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.10.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.paulcwarren:content-rest-spring-boot-starter...

org.springframework.data:spring-data-rest-webmvc (2.3.1.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.3.1.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-webmvc...

io.fabric8.jube.images.fabric8:springboot-webmvc (>=2.2.7, <=2.2.28), org.springframework.boot:spring-boot-starter-data-rest (>=1.2.5.release, <=1.2.6.release) +2 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.2.3.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - io.fabric8.jube.images.fabric8:springboot-webmvc =2.2.7,...

org.springframework.boot:spring-boot-starter-data-rest (>=1.1.11.release, <=1.1.12.release), org.springframework.data:spring-data-rest-webmvc (2.1.5.release) potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.1.5.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

org.springframework.boot:spring-boot-starter-data-rest (1.5.18.release), org.springframework.data:spring-data-rest-hal-browser (2.6.17.release) +1 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.6.17.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.github.zhycn:xbird-starter-swagger2 (>=1.0.0, <=1.3.0), com.heapbrain:testdeed (>=1.2.6, <=1.3.2) +11 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.6.9.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.6.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - com.github.zhycn:xbird-starter-swagger2 =1.0.0, =1.2.6,...