SA
Product
Spring AI
23
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 14Medium 7Low 0
Watch
Add Spring AI to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59294 | 6.5 | Aug 27 | Arbitrary File Write via Path Traversal in ResourceCacheService Affected: before 1.0.10; 1.1.0 before 1.1.9; 2.0.0 before 2.0.0.1 |
| CVE-2026-41863 | 6.5 | May 25 | LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API Affected: 1.1.0 before 1.1.7 |
| CVE-2026-40980 | 6.5 | Apr 28 | In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper` Affected: 1.0.0 before 1.0.6; 1.1.0 before 1.1.5 |
| CVE-2026-40979 | 6.1 | Apr 28 | In Spring AI, having access to a shared environment can expose the ONNX model used by the application Affected: 1.0.0 before 1.0.6; 1.1.0 before 1.1.5 |
| CVE-2026-40966 | 5.9 | Apr 28 | VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration Affected: 1.0.0 before 1.0.6; 1.1.0 before 1.1.5 |
| CVE-2026-59319 | 4.3 | Aug 27 | RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure Affected: 2.0.0 before 2.0.1 |
| CVE-2026-59308 | 4.3 | Aug 21 | Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation Affected: 2.0.0 before 2.0.1 |
Showing 7