CVE-2026-40979

In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 fixed in 1.0.6, 1.1.0 - 1.1.4 fixed in 1.1.5...

CVE-2026-40966

In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input a...

CVE-2026-40968

When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions. Affected versions:...

CVE-2026-44308

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...

CVE-2026-41712

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

CVE-2026-40982

A flaw was found in Spring Cloud Config. A remote attacker can exploit a directory traversal vulnerability by sending a specially crafted URL to the spring-cloud-config-server module. This allows the attacker to access arbitrary text and binary files on the system. Mitigation Mitigation for this...

CVE-2026-40978

SQL injection vulnerability in Spring AI's CosmosDBVectorStore allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions: Spring AI: 1.0.0 - 1.0.5 fixed in 1.0.6, 1.1.0 - 1.1.4 fixed in 1.1.5...

CVE-2026-40981

A flaw was found in Spring Cloud Config. When utilizing Google Secrets Manager as a backend, a remote client can craft a specific request to the config server. This action may lead to the unintended exposure of secrets from other Google Cloud Platform GCP projects, resulting in sensitive...

Denial Of Service (DoS)

Spring Cloud Function is vulnerable to Denial of Service DoS. The vulnerability is due to insufficient restrictions on function registration within the Function Registry, allowing an attacker to register an unbounded number of functions and trigger excessive memory consumption, potentially...

BIT-ACTIVEMQ-2026-42588 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy...

com.github.tommyettinger:tantrum-digital (0.9.9.20), com.github.tommyettinger:tantrum-jdkgdxds (>=1.14.1.20, <=2.1.1.20) +19 more potentially affected by CVE-2026-50076 via org.apache.fory:fory-core (0.14.1)

org.apache.fory:fory-core MAVEN version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.fory:fory-core and may be impacted: - com.github.tommyettinger:tantrum-digital 0.9.9.20 - com.github.tommyettinger:tantrum-jdkgdxds =1.14.1.20,...

com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0) potentially affected by CVE-2026-44488 via org.webjars.npm:axios (1.7.2)

org.webjars.npm:axios MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:axios and may be impacted: - com.github.linyuzai:concept-plugin-spring-boot-starter =2.0.0, =3.0.0 Source cves: CVE-2026-44488 Source advisory:...

org.apache.axis2:axis2-integration (1.4), org.apache.camel:camel-example-cxf (>=1.2.0, <=1.3.0) +3 more potentially affected by CVE-2026-42253 via org.apache.activemq:apache-activemq (>=4.1.1, <=5.0.0)

org.apache.activemq:apache-activemq MAVEN version =4.1.1, =1.2.0, =1.1.0, =1.3.0 - org.apache.camel:camel-example-spring 1.2.0 - org.apache.camel:camel-example-spring-xquery 1.3.0 Source cves: CVE-2026-42253 Source advisory: MEND:CVE-2026-42253...

CVE-2026-10152

A vulnerability was detected in TaleLin lin-cms-spring-boot up to 0.2.1. This issue affects some unknown processing of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation results in improper access controls. The attac...

org.apache.mina:mina-example (1.0.3), org.apache.mina:mina-filter-compression (1.0.3) +4 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.0.3)

org.apache.mina:mina-core MAVEN version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.0.3 - org.apache.mina:mina-filter-compression 1.0.3 -...

org.apache.mina:mina-example (1.1.3), org.apache.mina:mina-filter-codec-netty (1.1.3) +5 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.1.3)

org.apache.mina:mina-core MAVEN version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.1.3 - org.apache.mina:mina-filter-codec-netty 1.1.3 -...

org.apache.mina:mina-example (1.0.5), org.apache.mina:mina-filter-compression (1.0.5) +4 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.0.5)

org.apache.mina:mina-core MAVEN version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.0.5 - org.apache.mina:mina-filter-compression 1.0.5 -...

org.apache.mina:mina-example (1.1.1), org.apache.mina:mina-filter-compression (1.1.1) +3 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.1.1)

org.apache.mina:mina-core MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.1.1 - org.apache.mina:mina-filter-compression 1.1.1 -...

org.apache.archiva.redback.components:spring-apacheds (>=2.0, <=2.1), org.apache.directory.server:apacheds-core (1.5.1) +31 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.1.2)

org.apache.mina:mina-core MAVEN version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.archiva.redback.components:spring-apacheds =2.0, =0.9.7, =0.9.8 -...

org.apache.mina:mina-example (1.0.6), org.apache.mina:mina-filter-codec-netty (1.0.6) +5 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.0.6)

org.apache.mina:mina-core MAVEN version 1.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - org.apache.mina:mina-example 1.0.6 - org.apache.mina:mina-filter-codec-netty 1.0.6 -...