CVE-2026-22738

Critical 9.8 CVSS SpEL Injection and SSRF Flaws Hit Spring AI Framework

Spring AI Vulnerability Remote Code Execution (RCE)

Critical 9.8 CVSS SpEL Injection and SSRF Flaws Hit Spring AI Framework

Do Son March 26, 2026

Spring AI patches critical 9.8 CVSS SpEL injection (CVE-2026-22738), SSRF, and Cypher injection flaws. Secure your AI applications—upgrade to 1.1.4 now.

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2026-107441CVSS 8.8
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an...
Admin intel📅 Updated: Nov 4, 2026
CVE-2019-25779CVSS 8.7
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through...
Watchtower Verified📅 Updated: Nov 4, 2026
CVE-2023-54413CVSS 5.1
WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers...
Watchtower Verified📅 Updated: Nov 4, 2026
CVE-2026-81648CVSS 10.0
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of...
Admin intel📅 Updated: Nov 3, 2026
CVE-2026-119977CVSS 8.1
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable,...
CISA KEV📅 Added to KEV: Nov 3, 2026
CVE-2026-58115CVSS 10.0
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with...
Admin intel📅 Updated: Nov 2, 2026
CVE-2026-20051CVSS 7.4
A vulnerability with the Ethernet VPN (EVPN) Layer 2 ingress packet processing of Cisco Nexus 3600 Platform Switches...
Watchtower Verified📅 Updated: Nov 1, 2026
CVE-2026-20118CVSS 6.8
A vulnerability in the handling of an Egress Packet Network Interface (EPNI) Aligner interrupt in Cisco IOS XR...
Watchtower Verified📅 Updated: Nov 1, 2026

CVE-2026-121609CVSS 10.0
A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home...
📅 Updated: Nov 4, 2026
CVE-2026-51912CVSS 9.8
OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46).
📅 Updated: Nov 4, 2026
CVE-2026-107056CVSS 9.1
Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data...
📅 Updated: Nov 4, 2026
CVE-2026-107050CVSS 9.8
An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their...
📅 Updated: Nov 4, 2026
CVE-2026-107040CVSS 9.1
Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary...
📅 Updated: Nov 4, 2026
CVE-2026-107045CVSS 9.1
Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's...
📅 Updated: Nov 4, 2026
CVE-2026-121607CVSS 10.0
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the...
📅 Updated: Nov 4, 2026
CVE-2026-119050CVSS 9.2
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions...
📅 Updated: Nov 4, 2026