PT-2026-86015

Package spring-boot version 3.4.13-r0 fixes 2 vulnerabilities: ghsa-4265-ccf5-phj5, ghsa-4g9r-vxhx-9pgx...

kernel security update

4.18.0-553.148.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

kernel security, bug fix, and enhancement update

6.12.0-211.40.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

A Bootiful Podcast: Spring Boot founder and lead Phil Webb

Hi, Spring fans! In this installment I talk to Spring Boot cofounder Phil Webb who joins the show to unpack the latest Spring Boot 4.1 release, from the long-awaited Spring gRPC support and MongoDB batch starter to security, observability, service connections, and other polished improvements...

CVE-2026-47882: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

When enabling Spring Boot DevTools support for a remote application target for example a Docker container or Cloud Foundry app from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret w...

Secure Boot Bypass

The vulnerability of the Secure Boot implementation for Windows operating systems is related to errors in the implementation of security checks for standard elements. Exploiting this vulnerability can allow attackers to circumvent security restrictions...

com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.0, <=4.0.0-rc1) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.31.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - com.sap.hcp.cf.logging:sample-app-spring-boot =3.8.0,...

com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.0, <=4.0.0-rc1) potentially affected by CVE-2026-54712 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.31.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - com.sap.hcp.cf.logging:sample-app-spring-boot =3.8.0,...

Long-Lived Vulnerability in Microsoft Secure Boot

Microsoft's Secure Boot has had a serious vulnerability for most of its existence. An industry-wide standard Microsoft invented to protect Windows, and later Linux, devices from firmware infections has been trivial to bypass for 13 of its 14 years of existence. The discovery was made by researche...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 Failure Record: MT6985 Adaptation Attempt...

cve-2026-59327 - MEDIUM - CVE-2026-59327: Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

cve-2026-59326 - LOW - CVE-2026-59326: HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server

The Spring Boot language server logs the raw value of the httpsproxy / HTTPSPROXY / httpproxy / HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth...

cve-2026-47858 - HIGH - CVE-2026-47858: live information startup mode is vulnerable for remote code execution

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. This affects the live information feature across all environments Eclipse, Visual Studio Code, Theia, Cursor except the...

cve-2026-59328 - MEDIUM - CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

cve-2026-47882 - LOW - CVE-2026-47882: Spring Boot DevTools remote secret generated with a non-cryptographic PRNG

When enabling Spring Boot DevTools support for a remote application target for example a Docker container or Cloud Foundry app from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret w...

dependo

dependo A proof of concept for state-of-the-art observability...

Jeecg Boot <= 2.4.5 - Information Disclosure Detection

An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface. !/usr/bin/env python3 -- coding: utf-8 -- """An Insecure Permissions issue in jeecg-boot 2.""" from kittysploit import...

Spring Boot Actuator Logview Directory Traversal Detection

spring-boot-actuator-logview before version 0.2.13 contains a directory traversal vulnerability in libraries that adds a simple logfile viewer as a spring boot actuator endpoint maven package "eu.hinsch:spring-boot-actuator-logview". !/usr/bin/env python3 -- coding: utf-8 --...

Spring Boot Actuators (Jolokia) XXE Detection

A vulnerability in Spring Boot Actuators's 'jolokia' endpoint allows remote attackers to perform an XML External Entities XXE attack and include content stored on a remote server as if it was its own. This has the potential to allow the execution of arbitrary code and/or disclosure of sensitive...

Detects Springboot HTTP Exchanges Actuator

The exposed httpexchanges endpoint can leak recent HTTP request/response data, including URIs, headers, and status codes. !/usr/bin/env python3 -- coding: utf-8 -- """The exposed httpexchanges endpoint can leak recent HTTP request/response data, including URIs, headers, and st.""" from kittysploi...