Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.1In Spring AI, having access to a shared environment can expose the ONNX model used by the application.Apr 28, 2026
- High8.8SQL injection vulnerability in Spring AI's allows attackers to execute arbitrary SQL queries via crafted document IDs.Apr 28, 2026
- Medium5.9In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by inj…Apr 28, 2026
- High8.6In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages.Apr 28, 2026
- Medium6.7When an application is configured to use , a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is…Apr 28, 2026
- Critical9.1In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints.Apr 28, 2026
- High7.5Values produced by ${random.value} are not suitable for use as secrets.Apr 28, 2026
- Critical9.8Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.Apr 28, 2026
- High7.0A local attacker on the same host as the application may be able to take control of the directory used by .Apr 28, 2026
- High7.5An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret.Apr 28, 2026
- Critical9.1When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.Apr 27, 2026
- Medium6.8When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.Apr 27, 2026
- High7.5Vulnerability in Spring Spring Security.EPSS 0.3%Apr 22, 2026
- High7.5Vulnerability in Spring Spring Security.EPSS 0.2%Apr 22, 2026
- Medium6.5Vulnerability in Spring Spring Security.EPSS 0.2%Apr 22, 2026
- High8.1Vulnerability in Spring Spring Security.EPSS 0.3%Apr 22, 2026
- Low3.7Vulnerability in Spring Spring Security.EPSS 0.2%Apr 22, 2026
- Medium4.8Vulnerability in Spring Spring Security.EPSS 0.1%Apr 21, 2026
- High7.5When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL…EPSS 0.2%Apr 10, 2026
- High7.5In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts the value…EPSS 0.3%Mar 27, 2026
- High7.5Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter.EPSS 0.3%Mar 27, 2026
- High8.6Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that in…EPSS 0.4%Mar 27, 2026
- Critical9.8In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key.EPSS 1.1%Mar 27, 2026
- High8.6Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a b…EPSS 1.2%Mar 24, 2026
- Medium5.9Use of Java scripting engine enabled (e.g.EPSS 0.4%Mar 20, 2026