Skip to contentEclipse Foundation vulnerabilities
Newest
- eclipse foundation rdf4jIn Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE)...CVE-2026-158038.7 High
- eclipse glassfishIn Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources...CVE-2026-126059.6 Critical
- eclipse mojarraIn Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not...CVE-2026-465817.5 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes...CVE-2026-618917.5 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST...CVE-2026-600098.8 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend...CVE-2026-126097.5 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge`...CVE-2026-145745.7 Medium
- eclipse accessibility tools framework, eclipse foundation accessibility tools framework (actf), soumu michecker +2 moreIn Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code...CVE-2026-143044.6 Medium
- eclipse miloIn Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce...CVE-2026-632486.9 Medium
- eclipse miloIn Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a...CVE-2026-580808.8 High
- eclipse miloIn Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release...CVE-2026-632528.7 High
- eclipse miloIn Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed...CVE-2026-629278.7 High
- eclipse miloIn Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable...CVE-2026-600079.1 Critical
- eclipse miloIn Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception...CVE-2026-613876.9 Medium
- eclipse foundation csi - piaUnauthenticated SSRF in PIA via OIDC issuer allowlist bypassCVE-2026-183538.8 High
- eclipse foundation basyx go componentsCWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go ComponentsCVE-2026-157049.8 Critical
- eclipse jetty, eclipse foundation jetty - ee8, jetty - ee9 +2 moreDigest authentication lossy encodingCVE-2026-10050Fix available8.7 High
- eclipse openj9Eclipse OpenJ9 : Method resolution default method precedence failureCVE-2026-164416.9 Medium
- eclipse omrEclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zeroCVE-2026-162435.7 Medium
- eclipse openj9Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflowCVE-2026-164395.8 Medium
- eclipse hawkbit, eclipse foundation eclipse-hawkbit/hawkbit +1 morePrivilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware ExfiltrationCVE-2026-16454Fix available4.3 Medium
- eclipse jettyEclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requestsCVE-2024-7708Fix available7.5 High
- eclipse jettyEclipse Jetty: Path parameter traversalCVE-2026-8384Fix available5.3 Medium
- eclipse jettyEclipse Jetty: HTTP Authority/Host mismatchCVE-2026-6790Fix available5.3 Medium
- eclipse jettyEclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connectionsCVE-2026-10051Fix available6.9 Medium
- eclipse grizzly, eclipse foundation glassfish +1 moreEclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed...CVE-2026-126066.3 Medium
- eclipse vert.xIn Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirec…CVE-2026-150758.2 High
- eclipse vert.xIn versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession...CVE-2026-150768.2 High
- eclipse kura, the eclipse foundation eclipse kura +1 moreEclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the...CVE-2026-95618.8 High
- eclipse foundation basyx - java server sdkIn Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments...CVE-2026-578989.0 Critical
- eclipse kuksa, eclipse foundation kuksa - databroker +1 moreDatabroker 0.6.1 PublishValue missing data_point panicCVE-2026-136994.3 Medium
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the…CVE-2026-100558.5 High
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level au…CVE-2026-100548.8 High
- eclipse foundation csi - piaPIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as…CVE-2026-143368.2 High
- eclipse foundation parssonIn Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did...CVE-2026-95637.5 High
- eclipse open vsxIn Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files...CVE-2026-133234.1 Medium
- eclipse foundation csi - piaThe /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into three log statements before any validation g…CVE-2026-126166.9 Medium
- eclipse foundation tinydtls, the eclipse foundation eclipse tinydtls +1 moreEclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds...CVE-2026-92676.9 Medium
- eclipse open vsxOpen VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and...CVE-2026-49834.1 Medium
- eclipse threadx netx duo, eclipse foundation threadx - netx duo +1 moreThe security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally call…CVE-2026-115767.5 High
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task DefinitionsCVE-2026-44691Fix available8.4 High
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI ChatCVE-2026-22551Fix available6.7 Medium
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI ChatCVE-2026-46580Fix available8.4 High
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI ChatCVE-2026-44688Fix available8.4 High
- eclipse 4diac forte, eclipse foundation 4diac +1 moreIn Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to...CVE-2026-91585.2 Medium
- eclipse glassfishGlassFish's Administration Console is Vulnerable to RCECVE-2026-2586Public exploitFix available9.1 Critical
- eclipse glassfishGlassFish's gadget handler is vulnerable to RCECVE-2026-2587Public exploitFix available9.6 Critical
- eclipse vert.xVert.x has a DoS via unbounded server-side SNI SslContext cache growthCVE-2026-6860Fix available6.9 Medium
- eclipse foundation basyxEclipse BaSyx Java Server SDK vulnerable to Server-Side Request ForgeryCVE-2026-7412Fix available8.6 High
- eclipse foundation basyxEclipse BaSyx Java Server SDK vulnerable to Path TraversalCVE-2026-7411Fix available10.0 Critical
- Show moreLoading…