How many spring-projects spring-ai CVEs are in CISA KEV?

None of spring-projects spring-ai's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of spring-projects spring-ai are affected?

12 distinct spring-projects spring-ai versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in spring-projects spring-ai CVEs?

spring-projects spring-ai's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')), CWE-284 (Improper Access Control), CWE-377 (Insecure Temporary File).

How many critical spring-projects spring-ai vulnerabilities are there?

spring-projects spring-ai has 1 critical and 11 high-severity CVEs.

What is the average severity of spring-projects spring-ai CVEs?

The average CVSS base score across spring-projects spring-ai's scored CVEs is 7.9.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

spring-projects

16 CVEs

spring-projects spring-ai Vulnerabilities

Name: spring-projects spring-ai vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for spring-ai by spring-projects.

16

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

7.9

Avg CVSS

2026–2026

Last updated June 15, 2026

Overview

spring-projects spring-ai has 16 published CVE records since 2026, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 7.9.

This page aggregates every publicly disclosed vulnerability (CVE) affecting spring-projects spring-ai, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of spring-projects spring-ai's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High11

Medium4

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of spring-projects spring-ai's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No spring-projects spring-ai CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every spring-projects spring-ai version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

1.0.015 CVEs

Fixed in

057e111a93e61f911427a581207e853cf68085e95 CVEs
3d662709e1d5041efebf74753a6d119e5196952a5 CVEs
061d9a15313e32379c0bfe683df0d2e7e7ea96dc4 CVEs
a6a0aabd895126aa87d14c6381f26619f9174a104 CVEs
1086c3dd2d5305309600683856da598b05829b843 CVEs
10cd1f47dbb6ccb8ff7a9b0aa40892cc0c8af0eb3 CVEs
7bc46b52a8f8528d5be5fe6b51ce25c9a783964a2 CVEs
f1f6584d4a85c586c63724918695003cb4e0213a2 CVEs
634e8e30b6bcc3ea96b858406d9a0db1fe61ce791 CVE
d8503868d3e84547db51d8f10379e1a075fe2d991 CVE
eb3992ca27a9931ca79d7e2a817badfbb0fa68671 CVE

Find a version

16 CVEs

Sort

Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
CVE-2026-47835
Patch
CWE-943
High · CVSS 8.6
EPSS 0.3% (17th pct)2026-06-15
LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API
CVE-2026-41863
Patch
CWE-22
Medium · CVSS 6.5
EPSS 0.4% (32th pct)2026-05-25
Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
CVE-2026-41713
Patch
CWE-1336
High · CVSS 8.2
EPSS 0.2% (12th pct)2026-05-12
ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
CVE-2026-41712
Patch
High · CVSS 7.5
EPSS 0.3% (18th pct)2026-05-12
High vulnerability · 2026-05-09
CVE-2026-41705
Patch
CWE-917
High · CVSS 8.6
EPSS 0.4% (28th pct)2026-05-09
Medium vulnerability · 2026-04-28
CVE-2026-40980
Patch
CWE-400
Medium · CVSS 6.5
EPSS 0.2% (15th pct)2026-04-28
Medium vulnerability · 2026-04-28
CVE-2026-40979
Patch
CWE-377
Medium · CVSS 6.1
EPSS 0.1% (1th pct)2026-04-28
High vulnerability · 2026-04-28
CVE-2026-40978
Patch
CWE-89
High · CVSS 8.8
EPSS 0.3% (26th pct)2026-04-28
VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration
CVE-2026-40966
Patch
CWE-284
Medium · CVSS 5.9
EPSS 0.2% (14th pct)2026-04-28
High vulnerability · 2026-04-28
CVE-2026-40967
Patch
CWE-94
High · CVSS 8.6
EPSS 0.4% (32th pct)2026-04-28
High vulnerability · 2026-03-27
CVE-2026-22744
Patch
CWE-74
High · CVSS 7.5
EPSS 0.3% (16th pct)2026-03-27
Server-Side Request Forgery via Filter Expression Keys in Neo4jVectorStore
CVE-2026-22743
Patch
CWE-89
High · CVSS 7.5
EPSS 0.3% (16th pct)2026-03-27
Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching
CVE-2026-22742
Patch
CWE-918
High · CVSS 8.6
EPSS 0.4% (28th pct)2026-03-27
SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution
CVE-2026-22738
Patch
CWE-88
Critical · CVSS 9.8
EPSS 0.8% (53th pct)2026-03-27
CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
CVE-2026-22729
Patch
CWE-917
High · CVSS 8.6
EPSS 0.5% (41th pct)2026-03-18
CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter
CVE-2026-22730
Patch
CWE-89
High · CVSS 8.8
EPSS 0.5% (41th pct)2026-03-18

Common weakness types

The CWE weakness categories most often found in spring-projects spring-ai CVEs. Follow any weakness for its full explanation.

Other spring-projects products

Browse vulnerabilities for other products by spring-projects.

spring-framework37 CVEs spring-security31 CVEs spring-boot17 CVEs spring-amqp7 CVEs spring-data-commons7 CVEs spring-data-rest6 CVEs spring-security-oauth6 CVEs spring-graphql4 CVEs

All spring-projects vulnerabilities

Frequently asked questions

Common questions about spring-projects spring-ai vulnerabilities.

How many CVEs does spring-projects spring-ai have?: spring-projects spring-ai has 16 published CVE records since 2026.
How many spring-projects spring-ai CVEs are in CISA KEV?: None of spring-projects spring-ai's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for spring-projects spring-ai vulnerabilities?: No spring-projects spring-ai CVEs currently have a tracked public exploit in this dataset.
Which versions of spring-projects spring-ai are affected?: 12 distinct spring-projects spring-ai versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in spring-projects spring-ai CVEs?: spring-projects spring-ai's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')), CWE-284 (Improper Access Control), CWE-377 (Insecure Temporary File).
How many critical spring-projects spring-ai vulnerabilities are there?: spring-projects spring-ai has 1 critical and 11 high-severity CVEs.
What is the average severity of spring-projects spring-ai CVEs?: The average CVSS base score across spring-projects spring-ai's scored CVEs is 7.9.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track spring-projects spring-ai vulnerabilities

Monitor new spring-projects spring-ai vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing