CVE-2026-40979
MEDIUMDescription
In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
Is your site exposed to CVE-2026-40979?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| vmware | spring_ai |
| vmware | spring_ai |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2026-40979? +
How severe is CVE-2026-40979? +
What products are affected by CVE-2026-40979? +
How do I check if I'm vulnerable to CVE-2026-40979? +
Related Vulnerabilities
The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a …
Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a …
Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set …
Products for macOS enables a user logged on to the system to perform a denial-of-service attack, which could be misused …
Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an …
An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to …