Broadcom Spring Tools vulnerabilities

6 CVEs affecting Broadcom Spring Tools, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59328, published 2026-07-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-47858, published 2026-07-30. High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days. Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products…
CVE-2026-47873, published 2026-07-30. High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days. The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback. Affected Spring…
CVE-2026-47882, published 2026-07-30. High severity, CVSS 8.3. EPSS: 0.2% chance of exploitation in the next 30 days. When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared…
CVE-2026-59328, published 2026-07-30. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr…
CVE-2026-59326, published 2026-07-30. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit…
CVE-2026-59327, published 2026-07-30. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse…