ai.driftkit:driftkit-clients-spring-ai (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +494 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=1.0.0-m7, <=1.0.6)

org.springframework.ai:spring-ai-model MAVEN version =1.0.0-m7, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.7.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28 - ai.intelliswarm:swarmai-rag 1.0.28 and more Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-G...

com.alibaba.cloud.ai.autoconfigure.memory.long:spring-ai-alibaba-autoconfigure-memory-long (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (1.0.0.4) +3 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.0.0, <=1.0.1)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.0.0, =1.0.0.1, =1.0.0.3-20260305-cve - com.alibaba.cloud.ai:spring-ai-alibaba-studio-client 1.0.0.4 Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-GCQC...

com.alibaba.cloud.ai.autoconfigure.memory.long:spring-ai-alibaba-autoconfigure-memory-long (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (1.0.0.4) +3 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.0.0, <=1.0.1)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.0.0, =1.0.0.1, =1.0.0.3-20260305-cve - com.alibaba.cloud.ai:spring-ai-alibaba-studio-client 1.0.0.4 Source cves: CVE-2026-41712 Source advisory: GHSA-Q62F-H9X2-GCQC...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-memory-long (>=1.1.0.0-m3, <=1.1.2.4-security-fix), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (>=1.1.0.0-m3, <=1.1.2.4-security-fix) +11 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.1.0-m3, <=1.1.5)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.1.0-m3, =1.1.0.0-m3, =1.1.0.0-m3, =1.1.0.0-m3, =0.0.6, =1.1.19, =1.1.19, =1.1.19, =4.17.0, =4.17.0, =4.20.0 - org.vrspace:server 0.8.7 Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-GCQC...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-model-chat-memory-mem0 (2.0.0-m1.1), com.alibaba.cloud.ai:spring-ai-alibaba-model-chat-memory-repository-mem0 (2.0.0-m1.1) +2 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=2.0.0-m1, <=2.0.0-m4)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =2.0.0-m1, =0.1.0, =0.1.1 Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-GCQC...

Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +355 more potentially affected by CVE-2026-41713 via org.springframework.ai:spring-ai-client-chat (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-client-chat MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.6.0, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.0-m1.001, =1.1.4 and more Source cves: CVE-2026-41713 Source advisory: OSV:GHSA-5852-PHMH-8FHR...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +633 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-model MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.6 and more Source cves: CVE-2026-41712 Source advisory: OSV:GHSA-Q62F-H9X2-GCQC...

CVE-2026-41712

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

com.alibaba.cloud.ai.autoconfigure.memory.long:spring-ai-alibaba-autoconfigure-memory-long (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (1.0.0.4) +3 more potentially affected by CVE-2026-41713 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.0.0, <=1.0.1)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.0.0, =1.0.0.1, =1.0.0.3-20260305-cve - com.alibaba.cloud.ai:spring-ai-alibaba-studio-client 1.0.0.4 Source cves: CVE-2026-41713 Source advisory: MEND:CVE-2026-41713...

CVE-2026-41712

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +633 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=1.1.0-m1, <=1.1.5)

org.springframework.ai:spring-ai-model MAVEN version =1.1.0-m1, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.6 and more Source cves: CVE-2026-41712 Source advisory: MEND:CVE-2026-41712...

CVE-2026-41712 ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

com.alibaba.cloud.ai.autoconfigure.memory.long:spring-ai-alibaba-autoconfigure-memory-long (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-starter-memory-long (1.0.0.4) +3 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=1.0.0, <=1.0.1)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =1.0.0, =1.0.0.1, =1.0.0.3-20260305-cve - com.alibaba.cloud.ai:spring-ai-alibaba-studio-client 1.0.0.4 Source cves: CVE-2026-41712 Source advisory: MEND:CVE-2026-41712...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-model-chat-memory-mem0 (2.0.0-m1.1), com.alibaba.cloud.ai:spring-ai-alibaba-model-chat-memory-repository-mem0 (2.0.0-m1.1) +2 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-advisors-vector-store (>=2.0.0-m1, <=2.0.0-m4)

org.springframework.ai:spring-ai-advisors-vector-store MAVEN version =2.0.0-m1, =0.1.0, =0.1.1 Source cves: CVE-2026-41712 Source advisory: MEND:CVE-2026-41712...

ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4, <=1.2.6) +17 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model-chat-memory-repository-jdbc (>=1.1.0, <=1.1.5)

org.springframework.ai:spring-ai-model-chat-memory-repository-jdbc MAVEN version =1.1.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.19, =1.1.20 and more Source cves: CVE-2026-41712 Source advisory: MEND:CVE-2026-41712...

ai.driftkit:driftkit-clients-spring-ai (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +494 more potentially affected by CVE-2026-41712 via org.springframework.ai:spring-ai-model (>=1.0.0-m7, <=1.0.6)

org.springframework.ai:spring-ai-model MAVEN version =1.0.0-m7, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.7.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28 - ai.intelliswarm:swarmai-rag 1.0.28 and more Source cves: CVE-2026-41712 Source advisory: MEND:CVE-2026-41712...

CVE-2026-41712

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

EUVD-2026-29372

Due to improper Spring Security configuration, SAP Commerce cloud allows an unauthenticated user to perform malicious configuration upload and code injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the applicati...

CVE-2026-34263

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application...