The Eclipse Foundation vulnerabilities

Products

• Eclipse Jetty 23
• Eclipse Theia 18
• Eclipse Mosquitto 16
• Eclipse Openj9 14
• Eclipse Che 6
• Eclipse Vert.x 6
• Eclipse Kura 4
• Eclipse Californium 3
• Eclipse Omr 3
• Eclipse Birt 2
• Eclipse Hawkbit 2
• Eclipse Hono 2
• Eclipse Lyo 2
• Eclipse Memory Analyzer 2
• Eclipse Tinydtls 2

Newest

• eclipse foundation che, the eclipse foundation eclipse che +1 more Unauthenticated Command Injection via kubeconfig Username in che-machine-exec CVE-2026-114278 9.8 CriticalOctober 28, 2026
• eclipse foundation che, the eclipse foundation eclipse che +1 more In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory... CVE-2026-86671 8.4 HighOctober 5, 2026
• eclipse foundation che, the eclipse foundation eclipse che +1 more In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data... CVE-2026-86590 6.3 MediumSeptember 8, 2026
• eclipse foundation theia, the eclipse foundation eclipse theia +1 more In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change... CVE-2026-82217 8.8 HighAugust 31, 2026
• eclipse foundation lyo, the eclipse foundation eclipse lyo +1 more OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default CVE-2026-18918 9.1 CriticalAugust 28, 2026
• eclipse foundation theia, the eclipse foundation eclipse theia +1 more In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control... CVE-2026-19884 8.4 HighAugust 14, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes... CVE-2026-61891 7.5 HighAugust 5, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST... CVE-2026-60009 8.8 HighAugust 5, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend... CVE-2026-12609 7.5 HighAugust 5, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge`... CVE-2026-14574 5.7 MediumAugust 5, 2026
• eclipse kura, the eclipse foundation eclipse kura +1 more Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the... CVE-2026-9561 8.8 HighJuly 14, 2026
• eclipse foundation theia, the eclipse foundation eclipse theia +1 more In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the… CVE-2026-10055 8.5 HighJuly 3, 2026
• eclipse foundation theia, the eclipse foundation eclipse theia +1 more In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level au… CVE-2026-10054 8.8 HighJuly 3, 2026
• eclipse foundation tinydtls, the eclipse foundation eclipse tinydtls +1 more Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds... CVE-2026-9267 6.9 MediumJune 29, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more [Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions CVE-2026-44691 Fix available 8.4 HighJune 18, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat CVE-2026-22551 Fix available 6.7 MediumJune 18, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat CVE-2026-46580 Fix available 8.4 HighJune 18, 2026
• eclipse theia, the eclipse foundation eclipse theia +1 more [Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat CVE-2026-44688 Fix available 8.4 HighJune 18, 2026
• eclipse business intelligence and reporting tools, the eclipse foundation eclipse birt (business intelligence reporting tool) +1 more Improper Input Validation In Eclipse BIRT CVE-2023-0100 Fix available 8.8 HighMarch 15, 2023
• eclipse glassfish, the eclipse foundation eclipse glassfish +1 more Path Traversal In Eclipse GlassFish CVE-2022-2712 Fix available 6.5 MediumJanuary 27, 2023
• eclipse openj9, the eclipse foundation eclipse openj9 +1 more In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type... CVE-2022-3676 Fix available 6.5 MediumOctober 24, 2022
• eclipse sphinx, the eclipse foundation eclipse sphinx +1 more In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling... CVE-2022-2838 5.3 MediumAugust 16, 2022
• eclipse californium, the eclipse foundation eclipse californium +1 more Eclipse Californium denial of service (DoS) via Datagram Transport Layer Security (DTLS) handshake on parameter mismatch CVE-2022-2576 Fix available 7.5 HighJuly 29, 2022
• eclipse equinox p2, the eclipse foundation eclipse equinox p2 +1 more In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the... CVE-2021-41037 10.0 CriticalJuly 8, 2022
• eclipse lyo, the eclipse foundation eclipse lyo +1 more XML External Entity Reference in Eclipse Lyo CVE-2021-41042 Fix available 5.3 MediumJuly 7, 2022
• eclipse jetty, the eclipse foundation eclipse jetty +1 more Jetty SslConnection does not release pooled ByteBuffers in case of errors CVE-2022-2191 Fix available 7.5 HighJuly 7, 2022
• eclipse jetty, the eclipse foundation eclipse jetty, debian linux +5 more +7 more Jetty invalid URI parsing may produce invalid HttpURI.authority CVE-2022-2047 Fix available 2.7 LowJuly 7, 2022
• eclipse jetty, the eclipse foundation eclipse jetty, debian linux +6 more +8 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2022-2048 Fix available 7.5 HighJuly 7, 2022
• eclipse openj9, the eclipse foundation eclipse openj9, oracle java se +2 more In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during... CVE-2021-41041 5.3 MediumApril 27, 2022
• eclipse mosquitto, the eclipse foundation eclipse mosquitto +1 more In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number... CVE-2021-41039 Fix available 7.5 HighDecember 1, 2021
• eclipse theia, the eclipse foundation @theia/plugin-ext +1 more Improper Verification of Communication Channel in @theia/plugin-ext CVE-2021-41038 Fix available 6.1 MediumNovember 10, 2021
• the eclipse foundation eclipse paho mqtt c client, eclipse paho mqtt c\/c\+\+ client +1 more In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check rem_len... CVE-2021-41036 9.8 CriticalNovember 2, 2021
• eclipse openj9, eclipse foundation omr, the eclipse foundation eclipse omr +2 more In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for... CVE-2021-41035 9.8 CriticalOctober 25, 2021
• eclipse che, the eclipse foundation eclipse che +1 more The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an... CVE-2021-41034 8.1 HighSeptember 29, 2021
• eclipse equinox, the eclipse foundation eclipse equinox +1 more In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021),... CVE-2021-41033 8.1 HighSeptember 13, 2021
• eclipse theia, the eclipse foundation eclipse theia +1 more In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote... CVE-2021-34436 9.8 CriticalSeptember 2, 2021
• eclipse theia, the eclipse foundation eclipse theia +1 more Remote code execution in Eclipse Theia CVE-2021-34435 Fix available 8.8 HighSeptember 1, 2021
• eclipse mosquitto, the eclipse foundation eclipse mosquitto, fedoraproject fedora +2 more In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the... CVE-2021-34434 Fix available 5.3 MediumAugust 30, 2021
• eclipse californium, the eclipse foundation eclipse californium +1 more In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based ... CVE-2021-34433 7.5 HighAugust 20, 2021
• eclipse mosquitto, the eclipse foundation eclipse mosquitto +1 more In Eclipse Mosquitto versions 2.07 and earlier, the server will crash if the client tries to send... CVE-2021-34432 Fix available 7.5 HighJuly 27, 2021
• eclipse mosquitto, the eclipse foundation eclipse mosquitto +1 more In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with... CVE-2021-34431 Fix available 6.5 MediumJuly 22, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, netapp e-series santricity os controller +16 more +18 more Encoded URIs can access WEB-INF directory in Eclipse Jetty CVE-2021-34429 Public exploitFix available EPSS 99.3% 5.3 MediumJuly 15, 2021
• eclipse tinydtls, the eclipse foundation eclipse tinydtls +1 more Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it... CVE-2021-34430 7.5 HighJuly 8, 2021
• the eclipse foundation eclipse birt, eclipse business intelligence and reporting tools +1 more In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP... CVE-2021-34427 Public exploit EPSS 58.0% 9.8 CriticalJune 25, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, debian linux +14 more +16 more SessionListener can prevent a session from being invalidated breaking logout CVE-2021-34428 Public exploitFix available 2.9 LowJune 22, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, debian linux +6 more +8 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2021-28169 Fix available EPSS 78.5% 5.3 MediumJune 9, 2021
• eclipse jakarta expression language, the eclipse foundation jakarta expression language implementation, oracle communications cloud native core policy +2 more +4 more Improper Input Validation in Jakarta Expression Language CVE-2021-28170 Fix available 5.3 MediumMay 26, 2021
• eclipse jersey, the eclipse foundation eclipse jersey, oracle communications cloud native core policy +1 more +3 more Local information disclosure via system temporary directory CVE-2021-28168 Fix available 6.2 MediumApril 22, 2021
• eclipse openj9, the eclipse foundation eclipse openj9 +1 more In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes... CVE-2021-28167 6.5 MediumApril 21, 2021
• eclipse mosquitto, the eclipse foundation eclipse mosquitto +1 more In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with... CVE-2021-28166 Fix available 6.5 MediumApril 7, 2021
• Show olderLoading…