VDB
CVE-2026-40978
CVE-2026-40978
PUBLISHED
On April 27, 2026, Spring published security advisories to address vulnerabilities in the following product: Spring AI – 1.0.x versions prior to 1.0.6 Spring AI – 1.1.x versions prior to 1.1.5 The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
EPSS 0.34% · 26.4th percentile
Risk Scores
EPSS Score
0.34%
26.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| VMware | Spring AI – 1.1.x versions prior to 1.1.5 | |
| VMware | Spring AI – 1.0.x versions prior to 1.0.6 |
Timeline
- CVE Published
- May 16, 2026 Security Advisory
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 24, 2026 EPSS Score
- May 25, 2026 EPSS Score
- May 26, 2026 EPSS Score
- May 27, 2026 EPSS Score