SA
Product
Spring AI
by Spring · last CVE Aug 27, 2026
18
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 10Medium 6Low 0
Watch

Add Spring AI to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-59294
6.5
0%
Aug 27
Arbitrary File Write via Path Traversal in ResourceCacheService
Affected: 2.0.0; 1.1.0 through 1.1.8; through 1.0.9
CVE-2026-41863
6.5
0%
May 25
LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API
Affected: 1.1.0 through 1.1.x
CVE-2026-40980
6.5
0%
Apr 28
In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`
Affected: 1.0.0 before 1.0.6; 1.1.0 before 1.1.5
CVE-2026-40979
6.1
0%
Apr 28
In Spring AI, having access to a shared environment can expose the ONNX model used by the application
Affected: 1.0.0 before 1.0.6; 1.1.0 before 1.1.5
CVE-2026-59319
4.3
0%
Aug 27
RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure
Affected: 2.0.0
CVE-2026-59308
4.3
0%
Aug 21
Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation
Affected: 2.0.0
Showing 6