Known vulnerabilities in Spring AI 1.0.0-M7

Vendor: Broadcom
Software: Spring AI
Version: 1.0.0-M7
Software CPE: cpe:2.3:a:broadcom:spring_ai:*:*:*:*:*:*:*:*
Website: https://www.broadcom.com/
Total vulnerabilities: 17
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Spring AI version 1.0.0-M7 Spring AI 1.0.0-M7 is affected by 17 vulnerabilities: 6 high, 9 medium, 2 low Critical High Medium Low

Vulnerabilities (17)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU146244 - Uncontrolled Recursion
CVE-2026-47851		 CWE-674 Medium
No
No
 1.0.10, 1.1.9, 2.0.0.1 28.08.2026 SB20260828172
#VU146243 - Insecure Temporary File
CVE-2026-47852		 CWE-377 Medium
No
No
 1.0.10, 1.1.9, 2.0.0.1 28.08.2026 SB20260828172
#VU146194 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-47835		 CWE-74 High
No
No
 1.0.9, 1.1.8 28.08.2026 SB20260828161
#VU130984 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-41713		 CWE-74 High
No
No
 1.0.7, 1.1.6 11.05.2026 SB2026051173
#VU130983 - Improper Access Control
CVE-2026-41712		 CWE-284 Medium
No
No
 1.0.7, 1.1.6 11.05.2026 SB2026051173
#VU130982 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-41705		 CWE-89 High
No
No
 1.0.7, 1.1.6 11.05.2026 SB2026051173
#VU128386 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-22730		 CWE-89 Medium
No
No
 1.0.4, 1.1.3 28.04.2026 SB2026032733
#VU128383 - Improper Neutralization of Special Elements used in an Expression Language Statement
CVE-2026-22738		 CWE-917 High
No
No
 1.0.5, 1.1.4 28.04.2026 SB20260428208
#VU128382 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-22743		 CWE-89 Medium
No
No
 1.0.5, 1.1.4 28.04.2026 SB20260428208
#VU128381 - Server-Side Request Forgery (SSRF)
CVE-2026-22742		 CWE-918 High
No
No
 1.0.5, 1.1.4 28.04.2026 SB20260428208
#VU128380 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-22744		 CWE-74 Medium
No
No
 1.0.5, 1.1.4 28.04.2026 SB20260428208
#VU128241 - Uncontrolled Memory Allocation
CVE-2026-40980		 CWE-789 Low
No
No
 1.0.6, 1.1.5 27.04.2026 SB20260427184
#VU128240 - Incorrect Permission Assignment for Critical Resource
CVE-2026-40979		 CWE-732 Low
No
No
 1.0.6, 1.1.5 27.04.2026 SB20260427184
#VU128239 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-40978		 CWE-89 Medium
No
No
 1.0.6, 1.1.5 27.04.2026 SB20260427184
#VU128238 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-40967		 CWE-74 High
No
No
 1.0.6, 1.1.5 27.04.2026 SB20260427184
#VU128237 - Improper input validation
CVE-2026-40966		 CWE-20 Medium
No
No
 1.0.6, 1.1.5 27.04.2026 SB20260427184
#VU124651 - Improper Neutralization of Special Elements used in an Expression Language Statement
CVE-2026-22729		 CWE-917 Medium
No
No
 1.0.4, 1.1.3 27.03.2026 SB2026032733