Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the findByMetadata function. An attacker can access data from other conversations by injecting RediSearch syntax into user-controlled metadata fields. Remediation Upgrad...

io.github.loom-ai-labs:ai-fabric-provider-spring-ai (>=0.3.0, <=0.8.36), org.springframework.ai:spring-ai-starter-model-transformers (>=2.0.0-m1, <=2.0.0) +1 more potentially affected by CVE-2026-59294 via org.springframework.ai:spring-ai-transformers (>=2.0.0-m1, <=2.0.0)

org.springframework.ai:spring-ai-transformers MAVEN version =2.0.0-m1, =0.3.0, =2.0.0-m1, =2.0.0 - site.addzero:ai-agent 2026.06.20 Source cves: CVE-2026-59294 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-19267405...

cn.net.pap.example:pap4j-boot3-example-spring-ai (0.0.4), com.redis.om:redis-om-spring-ai (>=1.0.0-rc2, <=2.0.10) +6 more potentially affected by CVE-2026-47852 via org.springframework.ai:spring-ai-transformers (>=1.0.0, <=2.0.0)

org.springframework.ai:spring-ai-transformers MAVEN version =1.0.0, =1.0.0-rc2, =0.0.4, =0.3.0, =0.0.1, =0.2.2, =1.0.0, =2.0.0 - site.addzero:ai-agent 2026.06.20 Source cves: CVE-2026-47852 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-19267427...

This Week in Spring - August 18th, 2026

Hi, Spring fans! Welcome back to another edition of This Week in Spring. In my latest video, I dive into how to bake multitenancy into a system using Spring Security, OAuth, and a fantastic third-party project called Arconia. On that note, Arconia also shipped a fresh release that folds in severa...

Arbitrary Query Execution

Spring AI Vector Stores are vulnerable to Arbitrary Query Execution. The vulnerability is due to insufficient sanitization of special characters in vector store queries, allowing attackers to inject and execute arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB...

This Week in Spring - August 11th, 2026

Hi, Spring fans! Welcome back to another lively edition of This Week in Spring! So much is always happening in the Spring world, and that’s part of what makes it so fun to follow. One of my favorite things is how much the community contributes and how great it is to connect with everyone. In earl...

This Week in Spring - July 28th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! The title says in Spring , but here in the northern hemisphere, it's clearly the middle of summer. Hot! I'm sitting here on my laptop on a warm summer day, and my laptop is indeed hot because I've spent so much time outside...

This Week in Spring - July 21st, 2026

Welcome to another installment of This Week in Spring! I'm writing this while enjoying a cup of coffee from the Caribbean on a little PTO. How're you doin'? Whenever I go on PTO, I like to sit by some body of water with a coffee and a laptop nearby. I alternate between plunges in the ocean and...

Spring Office Hours Podcast: S5E18 - The Latest from OpenAI, Anthropic and Spring AI 2.0

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun catch up on the fast moving world of AI and what it means for Java developers. The guys will cover recent releases from OpenAI and Anthropic, then dig into Spring AI 2.0, which is n...

This Week in Spring - July 7th, 2026

This Week in Spring - July 7th, 2026 Hi, Spring fans! Welcome to another installment of This Week in Spring! We've got a lot to cover and I've got a plane to catch so let's go! What's that over on Spring Initializr? It's JobRunr, that's what! My favorite distributed job execution engine has...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the filter process. An attacker can bypass intended security restrictions by supplying specially crafted argument headers that are not properly validated...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.19.0, <=4.20.0)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49042 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17822332...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.17.0, <=4.18.2) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.17.0, <=4.18.2)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.17.0, =4.17.0, =4.18.2 Source cves: CVE-2026-49042 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17822332...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.19.0, <=4.20.0)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49042 Source advisory: GHSA-HH8R-75R6-QRG9...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.17.0, <=4.18.2) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.17.0, <=4.18.2)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.17.0, =4.17.0, =4.18.2 Source cves: CVE-2026-49042 Source advisory: OSV:GHSA-HH8R-75R6-QRG9...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.19.0, <=4.20.0)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49042 Source advisory: OSV:GHSA-HH8R-75R6-QRG9...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.17.0, <=4.18.2) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.17.0, <=4.18.2)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.17.0, =4.17.0, =4.18.2 Source cves: CVE-2026-49042 Source advisory: GHSA-HH8R-75R6-QRG9...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.19.0, <=4.20.0)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49042 Source advisory: MEND:CVE-2026-49042...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.17.0, <=4.18.2) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.17.0, <=4.18.2)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.17.0, =4.17.0, =4.18.2 Source cves: CVE-2026-49042 Source advisory: MEND:CVE-2026-49042...

K000161950: Spring AI vulnerability CVE-2026-22738

Security Advisory Description In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied...