Skip to contentEclipse Foundation vulnerabilities
Newest
- eclipse foundation threadx netx duoThe FTP client trusts arbitrary IP addresses in the PASV server responseCVE-2026-1027226.9 Medium
- eclipse foundation threadx netx duoTFTP client and server copy the ERROR packet message without bounding the read against the packetCVE-2026-1027216.9 Medium
- eclipse foundation threadx netx duoDHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options bufferCVE-2026-1027205.3 Medium
- eclipse foundation threadx netx duoNetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability checkCVE-2026-1027196.3 Medium
- eclipse foundation threadx netx duoOut-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER lengthCVE-2026-102718Public exploit8.7 High
- eclipse foundation threadx netx duoA malformed Session header permanently orphans one packet-pool block per RTSP requestCVE-2026-1027168.7 High
- eclipse foundation threadx netx duomDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packetCVE-2026-1027157.1 High
- eclipse foundation threadx netx duoICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanen…CVE-2026-1027147.1 High
- eclipse foundation threadx netx duoUnbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stallCVE-2026-1027138.3 High
- eclipse foundation threadx netx duoOut-of-bounds read in the NetX Secure DTLS ClientHello parserCVE-2026-1027126.3 Medium
- eclipse foundation threadxOut-of-bounds Read and Unverified Entry Pointers in the ThreadX Module LoaderCVE-2026-1027116.9 Medium
- eclipse foundation threadxAttacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION`...CVE-2026-1027108.5 High
- eclipse foundation threadxImproper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC)...CVE-2026-1027098.4 High
- eclipse foundation netx duoThe NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed...CVE-2026-1027628.2 High
- eclipse foundation netx duoNetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it...CVE-2026-1027619.3 Critical
- eclipse foundation netx duoWhen NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session...CVE-2026-1027608.3 High
- eclipse foundation netx duoNetX Secure TLS accepts an empty application-data record without verifying its message...CVE-2026-1027596.3 Medium
- eclipse foundation netx duoThe `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks...CVE-2026-1027587.5 High
- eclipse foundation threadxAn unprivileged, memory-protected ThreadX module can have the kernel read and write memory at...CVE-2026-1027578.5 High
- eclipse foundation jettyWhen Jetty's `HttpClient` make a request to a server through a forward proxy, the server may...CVE-2026-77711Fix available8.2 High
- eclipse foundation jettyIn Eclipse Jetty, HttpClient may receive a redirect of the form:
```
/secure/../evil
```...CVE-2026-76184Fix available8.2 High
- eclipse foundation jettyIn Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to...CVE-2026-76182Fix available6.9 Medium
- eclipse foundation open-vsx.orgReflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user dataCVE-2026-908828.7 High
- eclipse foundation open vsxUrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no che…CVE-2025-129999.1 Critical
- eclipse foundation iceoryx™In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as...CVE-2026-92612Fix available1.0 Low
- eclipse foundation ankaiosIn Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control...CVE-2026-926114.8 Medium
- eclipse foundation ankaiosIn Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control...CVE-2026-868368.4 High
- eclipse foundation data plane coreIn Siglet current and past versions the refresh token handler do not enforce proof of possession...CVE-2026-888196.3 Medium
- eclipse foundation embedded cdt (c/c++ development tools)In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised...CVE-2026-782999.1 Critical
- eclipse foundation openvsxPublishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by...CVE-2026-893214.3 Medium
- eclipse foundation dittoIn Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto...CVE-2026-841979.2 Critical
- eclipse foundation aeriosIn the current development version of Eclipse aeriOS, for which no official release has yet been...CVE-2026-864649.9 Critical
- eclipse foundation che, the eclipse foundation eclipse che +1 moreIn Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data...CVE-2026-865906.3 Medium
- eclipse foundation ankaiosIn Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by...CVE-2026-852016.8 Medium
- eclipse foundation ankaiosIn Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer...CVE-2026-841738.3 High
- eclipse foundation aeriosIn the current development version of Eclipse aeriOS, for which no official release has yet been...CVE-2026-847368.3 High
- eclipse foundation aeriosEclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability...CVE-2026-851998.8 High
- eclipse foundation arrowheadIn Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects...CVE-2026-805158.9 High
- eclipse foundation arrowheadIn Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the...CVE-2026-821809.5 Critical
- eclipse foundation aeriosIn the current development version of Eclipse aeriOS, which has not yet had an official release,...CVE-2026-829559.0 Critical
- eclipse foundation dittoIn Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }…CVE-2026-829587.6 High
- eclipse foundation dittoIn Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without va…CVE-2026-841755.3 Medium
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change...CVE-2026-822178.8 High
- eclipse foundation lyo, the eclipse foundation eclipse lyo +1 moreOAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed defaultCVE-2026-189189.1 Critical
- eclipse foundation jettyA client may send a WebSocket frame with an unknown opcode and a very large declared payload...CVE-2026-19204Fix available8.7 High
- eclipse foundation sw360In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipu…CVE-2026-796536.0 Medium
- eclipse foundation jettyA client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty...CVE-2026-19203Fix available8.3 High
- eclipse foundation jettyA client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are...CVE-2026-12611Fix available8.7 High
- eclipse foundation openj9In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations...CVE-2026-164405.7 Medium
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control...CVE-2026-198848.4 High
- Show moreLoading…