5 matches found
EUVD-2026-63933
In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege...
PT-2026-79377
Name of the Vulnerable Software and Affected Versions Spring AI version 2.0.0 Spring AI versions 1.1.0 through 1.1.8 Spring AI versions 1.0.0 through 1.0.9 Description In the tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced during...
CVE-2026-55979 Improper access control check in CatchPulse's named pipe communication interface
An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to operations that enforce more restrictive security policies...
