2159909 matches found
CVE-2026-59327
CVE-2026-59327 affects Spring Tools for Eclipse (5.2.0 and earlier). The issue is that the Spring Boot DevTools remote secret (spring.devtools.remote.secret) is stored as a plain string attribute on the "Spring Boot DevTools Client" launch configuration and persisted as cleartext XML, either in w...
CVE-2026-59328
Summary: CVE-2026-59328 affects Spring Tools for Eclipse (5.2.0 and earlier). The issue arises when the Spring Boot starter wizard’s dependency tooltips are rendered in a native embedded SWT Browser with JavaScript enabled, and untrusted/compromised Initializr endpoints are used. This can allow a...
CVE-2026-59328 Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips
Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...
CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations
Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...
CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations
Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...
CVE-2026-59328 Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips
Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...
CVE-2026-59328
Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...
CVE-2026-59327
Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...
EUVD-2026-50974
Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...
EUVD-2026-50975
Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...
gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb
A heap buffer overflow vulnerability was found in GStreamer's librfb RFB/VNC client. The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a...
CVE-2026-16527
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover. Mitigation To mitigate this issue, restrict network access ...
CVE-2026-17987
creationtimestamp| type| source ---|---|--- 2026-07-30 05:23:28+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730...
CVE-2026-17986
creationtimestamp| type| source ---|---|--- 2026-07-30 05:23:26+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730...
CVE-2026-17985
creationtimestamp| type| source ---|---|--- 2026-07-30 05:23:23+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730...
CVE-2026-17984
creationtimestamp| type| source ---|---|--- 2026-07-30 05:23:21+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730...
CVE-2026-17983
creationtimestamp| type| source ---|---|--- 2026-07-30 05:23:19+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730...
CVE-2026-17982
creationtimestamp| type| source ---|---|--- 2026-07-30 05:23:16+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730...