Eclipse vulnerabilities

Products

• Jetty 52
• Vert.x 27
• Mosquitto 26
• Openj9 23
• Threadx Netx Duo 21
• Theia 15
• Threadx Usbx 15
• Glassfish 13
• Jetty.project 7
• Milo 7
• Omr 7
• Kura 6
• Threadx 6
• Californium 4
• Che 4
• Cyclone Data Distribution Service 4
• Ide 4
• Mojarra 4
• Open Vsx 4
• Business Intelligence And Reporting Tools 3
• Hawkbit 3
• Hono 3
• Jgit 3
• Memory Analyzer 3
• Vert.x-web 3
• Cyclonedds 2
• Dataspace Components 2
• Equinox Osgi 2
• Jersey 2
• Keti 2
• Lemminx 2
• Openmq 2
• Parsson 2
• Rdf4j 2
• Tinydtls 2
• Wakaama 2
• Wild Web Developer 2

Newest

• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102477 8.7 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102464 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102461 8.7 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-103224 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-103223 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102466 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102463 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102469 9.2 CriticalOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102462 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102465 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy... CVE-2026-102475 8.7 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102467 8.7 HighOctober 15, 2026
• eclipse vert.x CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages CVE-2026-102471 6.9 MediumOctober 14, 2026
• eclipse vert.x In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets w… CVE-2026-102479 8.7 HighOctober 14, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102460 8.6 HighOctober 14, 2026
• eclipse glassfish In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources... CVE-2026-12605 9.6 CriticalAugust 6, 2026
• eclipse mojarra In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not... CVE-2026-46581 Fix available 7.5 HighAugust 5, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes... CVE-2026-61891 7.5 HighAugust 5, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST... CVE-2026-60009 8.8 HighAugust 5, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend... CVE-2026-12609 7.5 HighAugust 5, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge`... CVE-2026-14574 5.7 MediumAugust 5, 2026
• eclipse accessibility tools framework, eclipse foundation accessibility tools framework (actf), soumu michecker +2 more In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code... CVE-2026-14304 4.6 MediumAugust 5, 2026
• eclipse milo In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce... CVE-2026-63248 6.9 MediumAugust 4, 2026
• eclipse milo In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a... CVE-2026-58080 8.8 HighAugust 4, 2026
• eclipse milo In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release... CVE-2026-63252 8.7 HighAugust 4, 2026
• eclipse milo In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed... CVE-2026-62927 8.7 HighAugust 4, 2026
• eclipse milo In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable... CVE-2026-60007 9.1 CriticalAugust 4, 2026
• eclipse milo In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception... CVE-2026-61387 6.9 MediumAugust 4, 2026
• eclipse jetty, eclipse foundation jetty - ee8, jetty - ee9 +2 more Digest authentication lossy encoding CVE-2026-10050 Fix available 8.7 HighJuly 22, 2026
• eclipse openj9 Eclipse OpenJ9 : Method resolution default method precedence failure CVE-2026-16441 Fix available 6.9 MediumJuly 21, 2026
• eclipse omr Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero CVE-2026-16243 Fix available 5.7 MediumJuly 21, 2026
• eclipse openj9 Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow CVE-2026-16439 Fix available 5.8 MediumJuly 21, 2026
• eclipse hawkbit, eclipse foundation eclipse-hawkbit/hawkbit +1 more Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration CVE-2026-16454 4.3 MediumJuly 21, 2026
• eclipse jetty Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests CVE-2024-7708 Fix available 7.5 HighJuly 14, 2026
• eclipse jetty Eclipse Jetty: Path parameter traversal CVE-2026-8384 Fix available 5.3 MediumJuly 14, 2026
• eclipse jetty Eclipse Jetty: HTTP Authority/Host mismatch CVE-2026-6790 Fix available 5.3 MediumJuly 14, 2026
• eclipse jetty Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections CVE-2026-10051 Fix available 6.9 MediumJuly 14, 2026
• eclipse grizzly, eclipse foundation glassfish +1 more Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed... CVE-2026-12606 6.3 MediumJuly 14, 2026
• eclipse vert.x In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirec… CVE-2026-15075 8.2 HighJuly 14, 2026
• eclipse vert.x In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession... CVE-2026-15076 8.2 HighJuly 14, 2026
• eclipse kura, the eclipse foundation eclipse kura +1 more Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the... CVE-2026-9561 8.8 HighJuly 14, 2026
• eclipse kuksa, eclipse foundation kuksa - databroker +1 more Databroker 0.6.1 PublishValue missing data_point panic CVE-2026-13699 4.3 MediumJuly 14, 2026
• eclipse open vsx In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files... CVE-2026-13323 4.1 MediumJuly 1, 2026
• eclipse open vsx Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and... CVE-2026-4983 4.1 MediumJune 23, 2026
• eclipse threadx netx duo, eclipse foundation threadx - netx duo +1 more The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally call… CVE-2026-11576 7.5 HighJune 19, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more [Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions CVE-2026-44691 Fix available 8.4 HighJune 18, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat CVE-2026-22551 Fix available 6.7 MediumJune 18, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat CVE-2026-46580 Fix available 8.4 HighJune 18, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more [Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat CVE-2026-44688 Fix available 8.4 HighJune 18, 2026
• eclipse 4diac forte, eclipse foundation 4diac +1 more In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to... CVE-2026-9158 5.2 MediumJune 18, 2026
• Show olderLoading…