EUVD-2026-50979

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...

CVE-2026-59326

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...

CVE-2026-47858

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Thei...

CVE-2026-47858 live information startup mode is vulnerable for remote code execution

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Thei...

CVE-2026-47858 live information startup mode is vulnerable for remote code execution

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Thei...

CVE-2026-47858 live information startup mode is vulnerable for remote code execution

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Thei...

CVE-2026-47858

CVE-2026-47858 affects Spring Tools environments when the live information startup mode is enabled in Spring Tools for Eclipse (5.2.0 and earlier) and Spring Tools for VSCode/Cursor/Theia (2.2.0 and earlier). The vulnerability is described as a JMX-based remote code execution risk arising from th...

CVE-2026-59326: Insertion of Sensitive Information into Log File

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...

CVE-2026-47858: Missing Authentication for Critical Function

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Thei...

PT-2026-66364

Name of the Vulnerable Software and Affected Versions Spring Tools for Eclipse versions prior to 5.2.1 Spring Tools for VSCode / Cursor / Theia versions prior to 2.2.1 Description Starting Spring Boot applications in Spring Tools with the live information mode enabled allows for remote code...

VSCode SFTP File Exposure Detection

It discloses sensitive files created by vscode-sftp for VSCode, contains SFTP/SSH server details and credentials. !/usr/bin/env python3 -- coding: utf-8 -- """It discloses sensitive files created by vscode-sftp for VSCode, contains SFTP/SSH server details and credentia.""" from kittysploit import...

Visual Studio Code Directories - Detect

Visual Studio Code directories were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Visual Studio Code directories were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Visual Studio Code Directories ...

Malicious code in vscode-component-explorer (npm)

--- Credit: OpenSSF source...

Malicious code in mypypipkg (PyPI)

Source: kam193 a94a9bbd6a292f754fedd6ae737eaf5259925cf382a610c9d63e9d210a3f3677 When running as a module, the package starts a VSCode tunnel and exfiltrates the connection link to the hardcoded target. This lets the attacker connect the VSCode instance online and gain remote access to the machine...

CVE-2026-46412 Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

Malware in salesforce-vscode-slds

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview salesforce-vscode-slds is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

CVE-2026-59831

GitHub CLI gh is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopbac...

CVE-2026-59831

GitHub CLI gh is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopbac...

CVE-2026-59831: Inclusion of Functionality from Untrusted Control Sphere

GitHub CLI gh is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopbac...