By weakness (CWE)

CWE-917: related vulnerabilities

CVEs classified under CWE-917. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

6 published vulnerabilities

• CVE-2026-41717HIGH 8.1

  Spring Data MongoDB has a vulnerability where specially crafted database queries can execute arbitrary code on your application server. This happens when developers use the @Query annotation with certain placeholder patterns in their custom repository methods. An attacker who can influence the query parameters—either through application input or by compromising a data source—can inject malicious expressions that the framework will execute with your application's privileges.

• CVE-2026-41729HIGH 8.1

  Spring Data REST, a popular framework for building REST APIs on top of Spring Data repositories, contains a vulnerability in how it processes JSON Patch requests when entities include Map-type properties. An authenticated attacker can inject malicious SpEL (Spring Expression Language) expressions by crafting a specially formatted JSON Patch request. The framework fails to sanitize the map key derived from the JSON Pointer path, allowing the attacker to execute arbitrary code on the server. This requires valid credentials but no additional user interaction to exploit.

• CVE-2026-57281HIGH 7.5

  Jenkins Script Security Plugin versions up to 1402.v94c9ce464861 contain a sandbox escape vulnerability. The plugin is designed to safely execute Groovy scripts within a restricted environment, but it fails to properly validate certain Groovy language features called AST transformation annotations. An attacker who can submit sandboxed Groovy scripts to a Jenkins instance can craft malicious code that uses these annotations to break out of the sandbox and execute arbitrary commands with the privileges of the Jenkins process. This requires the attacker to already have legitimate script execution permissions and relies on specific script libraries being available, but the impact—full code execution outside sandbox controls—is severe.

• CVE-2026-8888HIGH 7.5

  The Securly Chrome Extension version 3.0.7 has a vulnerability that allows attackers on the network path between a user and Securly's servers to inject malicious patterns into configuration files. When the extension processes these patterns as regular expressions, it can trigger a computational flaw that freezes the browser during all web activity. This requires the attacker to be positioned to intercept traffic (such as on a shared network or through DNS hijacking) but does not require user interaction or authentication.

• CVE-2026-40985MEDIUM 6.4

  Spring Web Flow applications that use the WebFlowELExpressionParser are vulnerable to malicious Unified EL (Expression Language) expressions. An authenticated user with some social engineering (such as tricking a legitimate user into clicking a link or interacting with a crafted form) could inject harmful expressions into the application, potentially exposing sensitive data or modifying application state. The vulnerability requires user interaction and authenticated access, making it a moderate-risk issue for organizations running vulnerable Spring Web Flow versions.

• CVE-2026-41719MEDIUM 6.4

  Spring Data KeyValue and Spring Data Redis are widely used libraries for integrating key-value stores with Spring applications. A vulnerability in these libraries allows an attacker with authenticated access to inject malicious SpEL (Spring Expression Language) code through the Sort parameter of repository query methods. When the application passes unsanitized user input to sorting operations, the SpelPropertyComparator evaluates that input as executable code rather than treating it as data. This could allow an authenticated user to read sensitive data, modify application behavior, or degrade system availability.