am.ik.servicebroker:cloud-karafka-service-broker (>=0.0.2, <=0.0.3), cn.antcore:spring-boot-starter-security (1.0.0) +203 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (8.5.28)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.28 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - am.ik.servicebroker:cloud-karafka-service-broker =0.0.2, =0.1.0, =1.2.0,...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8891 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.54)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-43513 Source advisory: GHSA-5MP6-JRQ3-R938...

biz.jovido:jovido-webseed (>=0.0.1, <=0.0.1-fenicesfa), biz.jovido:jovido-webseed-fenicesfa (0.0.1) +220 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (8.5.15)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - biz.jovido:jovido-webseed =0.0.1, =1.0.1, =1.1.12, =1.1.12, =1.2.28, =1.1.2,...

cn.springboot:best-pay-sdk (1.3.1), cn.ttpai.framework:ttpai-rose-spring-boot-starter (1.0.2) +136 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.5.40)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - cn.springboot:best-pay-sdk 1.3.1 -...

de.skiptag.roadrunner:roadrunner-servlet (0.1), de.skiptag.roadrunner:roadrunner-spring (0.1) +8 more potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat-catalina (7.0.35)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.35 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - de.skiptag.roadrunner:roadrunner-servlet 0.1 - de.skiptag.roadrunner:roadrunner-spring 0.1 -...

io.github.davidalmeidac:sealed-env-spring-boot-starter (>=0.1.0-alpha.1, <=0.1.0-alpha.3) potentially affected by CVE-2026-45091 via io.github.davidalmeidac:sealed-env-core (>=0.1.0-alpha.1, <=0.1.0-alpha.3)

io.github.davidalmeidac:sealed-env-core MAVEN version =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3 Source cves: CVE-2026-45091 Source advisory: GHSA-X3R2-FJ3R-G5MV...

io.github.davidalmeidac:sealed-env-spring-boot-starter (>=0.1.0-alpha.1, <=0.1.0-alpha.3) potentially affected by CVE-2026-45091 via io.github.davidalmeidac:sealed-env-core (>=0.1.0-alpha.1, <=0.1.0-alpha.3)

io.github.davidalmeidac:sealed-env-core MAVEN version =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3 Source cves: CVE-2026-45091 Source advisory: OSV:GHSA-X3R2-FJ3R-G5MV...

io.github.davidalmeidac:sealed-env-spring-boot-starter (>=0.1.0-alpha.1, <=0.1.0-alpha.3) potentially affected by CVE-2026-45091 via io.github.davidalmeidac:sealed-env-core (>=0.1.0-alpha.1, <=0.1.0-alpha.3)

io.github.davidalmeidac:sealed-env-core MAVEN version =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3 Source cves: CVE-2026-45091 Source advisory: MEND:CVE-2026-45091...

ai.driftkit:driftkit-clients-spring-ai (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +346 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-client-chat (>=1.0.0-m7, <=1.0.6)

org.springframework.ai:spring-ai-client-chat MAVEN version =1.0.0-m7, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.7.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28 - ai.intelliswarm:swarmai-rag 1.0.28 and more Source cves: CVE-2026-41712 Source advisory:...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-model-chat-memory-mem0 (2.0.0-m1.1), com.alibaba.cloud.ai:spring-ai-alibaba-model-chat-memory-repository-mem0 (2.0.0-m1.1) +2 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=2.0.0-m1, <=2.0.0-m4)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =2.0.0-m1, =0.1.0, =0.1.1 Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +355 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-client-chat (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-client-chat MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.6.0, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.4 and more Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +355 more potentially affected by CVE-2026-41713 via org.springframework.ai:spring-ai-client-chat (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-client-chat MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.6.0, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.4 and more Source cves: CVE-2026-41713 Source advisory: GHSA-5852-PHMH-8FHR...

ai.driftkit:driftkit-clients-spring-ai (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +346 more potentially affected by CVE-2026-41713 via org.springframework.ai:spring-ai-client-chat (>=1.0.0-m7, <=1.0.6)

org.springframework.ai:spring-ai-client-chat MAVEN version =1.0.0-m7, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.7.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28 - ai.intelliswarm:swarmai-rag 1.0.28 and more Source cves: CVE-2026-41713 Source advisory:...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +633 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-model MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.6 and more Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

GHSA-Q62F-H9X2-GCQC Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

GHSA-5852-PHMH-8FHR Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor

A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns...

ai.driftkit:driftkit-clients-spring-ai (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +494 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=1.0.0-m7, <=1.0.6)

org.springframework.ai:spring-ai-model MAVEN version =1.0.0-m7, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.7.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28 - ai.intelliswarm:swarmai-rag 1.0.28 and more Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0, <=0.3.0) +133 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-client-chat (>=2.0.0-m1, <=2.0.0-m5)

org.springframework.ai:spring-ai-client-chat MAVEN version =2.0.0-m1, =0.1.0, =0.1.0, =1.22.3, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-memory-long (>=1.1.0.0-m3, <=1.1.2.4-security-fix), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (>=1.1.0.0-m3, <=1.1.2.4-security-fix) +11 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.1.0-m3, <=1.1.5)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.1.0-m3, =1.1.0.0-m3, =1.1.0.0-m3, =1.1.0.0-m3, =0.0.6, =1.1.19, =1.1.19, =1.1.19, =4.17.0, =4.17.0, =4.20.0 - org.vrspace:server 0.8.7 Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +355 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-client-chat (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-client-chat MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.6.0, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.4 and more Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-GCQC...