AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

VMwareCVE-2026-47882

When enabling Spring Boot DevTools support for a remote application target

VMware

CVE-2026-47882 · Published Jul 30, 2026 · updated Sep 30, 2026

High8.3
No fix yet
VMware advisory

When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness.

Affected Spring Products and Versions:

Spring Tools for Eclipse: 5.2.0 and earlier

Affected versions

PackageAffectedFixed in
Spring Tools for Eclipse
Product
<= 5.2.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-338

More VMware advisories

All VMware
Low 2.7Jul 30VMware ESX contains an insufficient logging vulnerabilityCVE-2026-41709fixed in 5.2.4 +3Critical 9.8Jul 30VMware Cloud Foundation: authentication bypassCVE-2026-59309fixed in 9.1.0.0300 +2Critical 9.8Jul 30VMware Cloud Foundation: path traversalCVE-2026-59310fixed in 9.1.0.0300 +2Critical 9.3Jul 30VMware Cloud Foundation: out-of-bounds writeCVE-2026-47876fixed in ESXi-9.1.0.0200-25557999 +2High 7.6Jul 30VMware Cloud Foundation: out-of-bounds readCVE-2026-41703fixed in 5.2.3 +4Low 3.3Jul 30VMware Spring Tools for: secrets in logsCVE-2026-59326no fix yet