CVE-2026-40978

SQL injection vulnerability in Spring AI's CosmosDBVectorStore allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions: Spring AI: 1.0.0 - 1.0.5 fixed in 1.0.6, 1.1.0 - 1.1.4 fixed in 1.1.5...

MAL-2026-4537 Malicious code in cosmosdb-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 925077d4c86616920b1ad20f2342df7473d9504764582235049e78eed9189a76 Package squats the unscoped name cosmosdb-server, targeting users who mistype npx cosmosdb-server instead of the scoped @vercel/cosmosdb-server. The...

GHSA-63C8-M9M2-CVR3 Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()

SQL injection vulnerability in Spring AI's CosmosDBVectorStore allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions: Spring AI: 1.0.0 - 1.0.5 fixed in 1.0.6, 1.1.0 - 1.1.4 fixed in 1.1.5...

CVE-2026-40978

SQL injection vulnerability in Spring AI's CosmosDBVectorStore allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions: Spring AI: 1.0.0 - 1.0.5 fixed in 1.0.6, 1.1.0 - 1.1.4 fixed in 1.1.5...

CVE-2026-40978

Summary: CVE-2026-40978 is a SQL injection vulnerability in Spring AI’s CosmosDBVectorStore. Affected versions: Spring AI 1.0.0–1.0.5 (fixed in 1.0.6) and 1.1.0–1.1.4 (fixed in 1.1.5). Issue: Attackers can trigger arbitrary SQL queries via crafted document IDs, enabling high-severity impact as pe...

MAL-2025-17630 Malicious code in cosmosdb (npm)

The package cosmosdb was found to contain malicious code...

Malicious code in cosmosdb (npm)

The package cosmosdb was found to contain malicious code...

com.couchbase.client:spark-connector_2.10 (=2.1.0), com.crealytics:spark-google-adwords_2.10 (=0.9.0) +64 more potentially affected by CVE-2018-8024 via org.apache.spark:spark-core_2.10 (>=2.1.0 <=2.1.2)

org.apache.spark:spark-core2.10 MAVEN version =2.1.0, =0.2.0, =1.0.5, =1.0.8, =1.0.9, =2.1.00.7.4, =2.1.00.12.0, =0.0.4, =1.0.0 - com.yahoo.pulsar:pulsar-spark =1.18 - edu.berkeley.cs.amplab:keystoneml2.10 =0.4.0 and more Source cves: CVE-2018-8024 Source advisory: OSV:GHSA-8CW6-5QVP-Q3WJ...