AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

VMwareCVE-2026-59328

VMware Spring Tools for Eclipse: spoofing

VMware

CVE-2026-59328 · Published Jul 30, 2026 · updated Sep 30, 2026

Medium4.2
No fix yet
VMware advisory

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution.

Affected Spring Products and Versions:

Spring Tools for Eclipse: 5.2.0 and earlier

Affected versions

PackageAffectedFixed in
Spring Tools for Eclipse
Product
<= 5.2.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-79

More VMware advisories

All VMware
Low 2.7Jul 30VMware ESX contains an insufficient logging vulnerabilityCVE-2026-41709fixed in 5.2.4 +3Critical 9.8Jul 30VMware Cloud Foundation: authentication bypassCVE-2026-59309fixed in 9.1.0.0300 +2Critical 9.8Jul 30VMware Cloud Foundation: path traversalCVE-2026-59310fixed in 9.1.0.0300 +2Critical 9.3Jul 30VMware Cloud Foundation: out-of-bounds writeCVE-2026-47876fixed in ESXi-9.1.0.0200-25557999 +2High 7.6Jul 30VMware Cloud Foundation: out-of-bounds readCVE-2026-41703fixed in 5.2.3 +4Low 3.3Jul 30VMware Spring Tools for: secrets in logsCVE-2026-59326no fix yet