Eclipse Foundation vulnerabilities

Products

• Jetty 39
• Vert.x 30
• Openj9 21
• Threadx Netx Duo 20
• Threadx 19
• Netx Duo 18
• Threadx 14
• Usbx 14
• Glassfish 13
• Theia 12
• Keypont - Gose 9
• Omr 8
• Threadx - Netx Duo 8
• Threadx - Guix 7
• Mosquitto 7
• Milo 6
• Jetty 6
• Csi - Pia 5
• Aerios 4
• Ankaios 4
• Ditto 4
• Iofog 4
• Openj9 4
• Che 3
• Connected Services Platform 3
• Mnestix 3
• Open Vsx 3
• Threadx - Usbx 3
• Arrowhead 2
• Basyx 2
• Basyx Helm Charts 2
• Kuksa - Databroker 2
• Mojarra 2
• Openmq 2
• Filex 2
• Glassfish 2
• Guix 2
• Jersey 2
• Nextx Duo 2
• Open J9 2
• Openvsx 2
• Parsson 2
• Vert.x 2

Newest

• eclipse foundation basyx helm charts Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts CVE-2026-123059 7.5 HighNovember 5, 2026
• eclipse foundation basyx helm charts Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts CVE-2026-123047 7.5 HighNovember 5, 2026
• eclipse foundation mojarra Reflected XSS via client window id in URL client window mode CVE-2026-120421 6.1 MediumNovember 4, 2026
• eclipse foundation vert.x Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser CVE-2026-118487 7.5 HighNovember 3, 2026
• eclipse foundation vert.x Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client CVE-2026-118488 5.9 MediumNovember 3, 2026
• eclipse foundation vert.x CachingWebClient shares user-specific HTTP responses across users via the shared cache tier CVE-2026-118489 7.5 HighNovember 3, 2026
• eclipse foundation mnestix Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter CVE-2026-89295 7.5 HighNovember 3, 2026
• eclipse foundation mnestix Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering CVE-2026-89293 8.8 HighNovember 3, 2026
• eclipse foundation mnestix Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures CVE-2026-89292 9.2 CriticalNovember 3, 2026
• eclipse foundation semantic modeling framework (esmf) Improper limitation of paths in py-aspect-model-loader CVE-2026-92610 9.8 CriticalNovember 3, 2026
• eclipse foundation threadx ThreadX Modules invokes trace-full callbacks after module unload CVE-2026-113421 7.3 HighNovember 3, 2026
• eclipse foundation threadx User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege CVE-2026-115231 8.5 HighNovember 3, 2026
• eclipse foundation threadx NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool CVE-2026-115215 8.7 HighNovember 2, 2026
• eclipse foundation threadx NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full CVE-2026-115403 8.2 HighNovember 2, 2026
• eclipse foundation threadx User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own CVE-2026-115654 6.9 MediumNovember 2, 2026
• eclipse foundation threadx Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode CVE-2026-115653 7.0 HighNovember 2, 2026
• eclipse foundation threadx netx duo NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full CVE-2026-114408 8.7 HighNovember 2, 2026
• eclipse foundation threadx Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation CVE-2026-118052 6.8 MediumNovember 2, 2026
• eclipse foundation che, the eclipse foundation eclipse che +1 more Unauthenticated Command Injection via kubeconfig Username in che-machine-exec CVE-2026-114278 9.8 CriticalOctober 28, 2026
• eclipse foundation keypont ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets CVE-2026-115408 5.5 MediumOctober 27, 2026
• eclipse foundation iofog iofogctl command injection via Controller provisioning response CVE-2026-113644 5.5 MediumOctober 27, 2026
• eclipse foundation iofog Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials CVE-2026-115216 9.1 CriticalOctober 27, 2026
• eclipse foundation keypont - gose HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity CVE-2026-89320 8.8 HighOctober 23, 2026
• eclipse foundation keypont - gose JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation CVE-2026-89319 6.3 MediumOctober 23, 2026
• eclipse foundation keypont - gose JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check) CVE-2026-89318 6.9 MediumOctober 23, 2026
• eclipse foundation keypont - gose JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11) CVE-2026-89317 6.3 MediumOctober 23, 2026
• eclipse foundation keypont - gose LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion CVE-2026-89316 6.3 MediumOctober 23, 2026
• eclipse foundation keypont - gose JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix CVE-2026-89315 6.9 MediumOctober 23, 2026
• eclipse foundation keypont - gose Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s CVE-2026-89314 6.9 MediumOctober 23, 2026
• eclipse foundation keypont - gose JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil CVE-2026-89313 6.3 MediumOctober 23, 2026
• eclipse foundation keypont - gose AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV CVE-2026-89312 6.9 MediumOctober 23, 2026
• eclipse foundation openj9 JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing CVE-2026-110938 8.7 HighOctober 21, 2026
• eclipse foundation openj9 JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization CVE-2026-111075 8.7 HighOctober 21, 2026
• eclipse foundation openj9 JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity() CVE-2026-111074 8.7 HighOctober 21, 2026
• eclipse foundation threadx - netx duo NetX Duo Web HTTP server interprets request body content as HTTP header fields CVE-2026-93003 6.9 MediumOctober 20, 2026
• eclipse foundation threadx Module object allocation size overflow corrupts the manager object pool CVE-2026-95107 7.0 HighOctober 20, 2026
• eclipse foundation threadx Module block-pool create validates two of the four parameter words it reads CVE-2026-94202 4.8 MediumOctober 20, 2026
• eclipse foundation threadx Deleting a user-mode module thread leaks its privileged kernel stack CVE-2026-95108 6.8 MediumOctober 20, 2026
• eclipse foundation threadx Module Manager object lookup validates one byte of a module's search name CVE-2026-94024 6.9 MediumOctober 20, 2026
• eclipse foundation threadx Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion CVE-2026-94023 6.9 MediumOctober 20, 2026
• eclipse foundation threadx Cortex-A7 module data validation checks only the first address of a caller-supplied range CVE-2026-95109 8.5 HighOctober 20, 2026
• eclipse foundation threadx Module object deallocation can free a live ThreadX kernel object CVE-2026-94192 8.5 HighOctober 20, 2026
• eclipse foundation threadx - netx duo Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure CVE-2026-92843 8.7 HighOctober 20, 2026
• eclipse foundation threadx - netx duo NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path CVE-2026-94018 8.8 HighOctober 20, 2026
• eclipse foundation threadx - netx duo Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure CVE-2026-92853 8.7 HighOctober 20, 2026
• eclipse foundation threadx - netx duo Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509 CVE-2026-93475 9.3 CriticalOctober 20, 2026
• eclipse foundation threadx - guix Out-of-bounds read when a multi-line text view string ends with a carriage return CVE-2026-91057 4.6 MediumOctober 20, 2026
• eclipse foundation threadx - guix JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode CVE-2026-92454 6.8 MediumOctober 20, 2026
• eclipse foundation threadx - guix JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size CVE-2026-91059 6.8 MediumOctober 20, 2026
• eclipse foundation threadx - guix GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme CVE-2026-91189 7.1 HighOctober 20, 2026
• Show olderLoading…