Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- High8.8When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent…EPSS 0.3%Apr 28, 2026
- Medium6.5In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by .EPSS 0.4%Apr 28, 2026
- Medium6.1In Spring AI, having access to a shared environment can expose the ONNX model used by the application.EPSS 0.2%Apr 28, 2026
- High8.8SQL injection vulnerability in Spring AI's allows attackers to execute arbitrary SQL queries via crafted document IDs.EPSS 0.4%Apr 28, 2026
- Medium5.9In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by inj…EPSS 0.4%Apr 28, 2026
- High8.6In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages.EPSS 0.4%Apr 28, 2026
- Medium6.7When an application is configured to use , a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is…EPSS 0.1%Apr 28, 2026
- Critical9.1In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints.EPSS 0.5%Apr 28, 2026
- High7.5Values produced by ${random.value} are not suitable for use as secrets.EPSS 0.4%Apr 28, 2026
- Critical9.8Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.EPSS 0.4%Apr 28, 2026
- High7.0A local attacker on the same host as the application may be able to take control of the directory used by .EPSS 0.1%Apr 28, 2026
- High7.5An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret.EPSS 0.3%Apr 28, 2026
- Critical9.1When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.EPSS 0.3%Apr 27, 2026
- Medium6.8When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.EPSS 0.2%Apr 27, 2026
- High7.5Vulnerability in Spring Spring Security.EPSS 0.3%Apr 22, 2026
- High7.5Vulnerability in Spring Spring Security.EPSS 0.2%Apr 22, 2026
- Medium6.5Vulnerability in Spring Spring Security.EPSS 0.2%Apr 22, 2026
- High8.1Vulnerability in Spring Spring Security.EPSS 0.3%Apr 22, 2026
- Low3.7Vulnerability in Spring Spring Security.EPSS 0.2%Apr 22, 2026
- Medium4.8Vulnerability in Spring Spring Security.EPSS 0.1%Apr 21, 2026
- High7.5When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL…EPSS 0.2%Apr 10, 2026
- High7.5In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts the value…EPSS 0.3%Mar 27, 2026
- High7.5Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter.EPSS 0.3%Mar 27, 2026
- High8.6Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that in…EPSS 0.4%Mar 27, 2026
- Critical9.8In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key.EPSS 1.1%Mar 27, 2026