Eclipse Foundation
197 CVEs across 78 Eclipse Foundation products. Browse Eclipse Foundation vulnerabilities, severities, and proof-of-concept exploits.
Eclipse Foundation products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-101322 | | 2026-10-01 | In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorizat… | |
CVE-2026-102717 | High | 7.5 | 2026-09-30 | MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash |
CVE-2026-102762 | | 2026-09-29 | The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the netw… | |
CVE-2026-102761 | | 2026-09-29 | NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound b… | |
CVE-2026-102760 | | 2026-09-29 | When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP laye… | |
CVE-2026-102759 | | 2026-09-29 | NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a decrypted application… | |
CVE-2026-102758 | High | 7.5 | 2026-09-29 | The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X… |
CVE-2026-102757 | | 2026-09-29 | An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that t… | |
CVE-2026-102730 | | 2026-09-29 | Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation… | |
CVE-2026-102729 | | 2026-09-29 | `gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id… | |
CVE-2026-102728 | High | 7.5 | 2026-09-29 | Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to conta… |
CVE-2026-102727 | | 2026-09-29 | FTP Passive Data Connection Not Bound to the Authenticated Control Peer | |
CVE-2026-102726 | | 2026-09-29 | Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read | |
CVE-2026-102725 | | 2026-09-29 | Out-of-bounds Read from Unvalidated MSRP Attribute List Length | |
CVE-2026-102724 | | 2026-09-29 | NULL Pointer Dereference When Evicting the Sole MSRP Attribute | |
CVE-2026-102723 | | 2026-09-29 | NULL Pointer Dereference on MSRP Attribute Table Exhaustion | |
CVE-2026-102722 | | 2026-09-29 | In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values… | |
CVE-2026-102721 | | 2026-09-29 | A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that… | |
CVE-2026-102719 | | 2026-09-29 | Predictable DTLS HelloVerifyRequest Cookie in NetX Secure | |
CVE-2026-102718 | | 2026-09-29 | hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID u… | |
CVE-2026-102716 | | 2026-09-29 | An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. … | |
CVE-2026-102714 | | 2026-09-29 | `_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one… | |
CVE-2026-102713 | | 2026-09-29 | The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) and nothing anywhere… | |
CVE-2026-102712 | | 2026-09-29 | On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record lengt… | |
CVE-2026-102711 | | 2026-09-29 | Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_tx… | |
CVE-2026-102710 | | 2026-09-29 | Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dispatch calls, on a build with `TX_ENABLE… | |
CVE-2026-102709 | | 2026-09-29 | Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secur… | |
CVE-2026-90882 | | 2026-09-22 | The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the a… | |
CVE-2026-92612 | | 2026-09-21 | In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts tho… | |
CVE-2025-12999 | | 2026-09-21 | UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forw… | |
CVE-2026-92611 | | 2026-09-17 | In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single… | |
CVE-2026-86836 | | 2026-09-14 | In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived fr… | |
CVE-2026-88819 | | 2026-09-14 | In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID. | |
CVE-2026-78299 | Critical | 9.1 | 2026-09-14 | In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations o… |
CVE-2026-89321 | Medium | 4.3 | 2026-09-14 | Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opene… |
CVE-2026-86464 | | 2026-09-08 | In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included inse… | |
CVE-2026-84197 | | 2026-09-08 | In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor p… | |
CVE-2026-19203 | | 2026-09-08 | A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boun… | |
CVE-2026-12611 | | 2026-09-08 | A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and… | |
CVE-2026-86590 | | 2026-09-08 | In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an… | |
CVE-2026-85201 | | 2026-09-07 | In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received thr… | |
CVE-2026-19204 | | 2026-09-07 | A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and pot… | |
CVE-2026-84173 | | 2026-09-07 | In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path… | |
CVE-2026-84736 | | 2026-09-03 | In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate va… | |
CVE-2026-85199 | | 2026-09-03 | Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, up… | |
CVE-2026-82180 | | 2026-09-03 | In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.50… | |
CVE-2026-80515 | | 2026-09-03 | In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its ch… | |
CVE-2026-82955 | | 2026-09-02 | In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had… | |
CVE-2026-82958 | | 2026-09-02 | In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting place… | |
CVE-2026-84175 | | 2026-09-02 | In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definitio… | |
CVE-2026-82217 | High | 8.8 | 2026-08-31 | In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replaceme… |
CVE-2026-18918 | | 2026-08-28 | In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, ap… | |
CVE-2026-79653 | | 2026-08-27 | In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.stor… | |
CVE-2026-16440 | | 2026-08-19 | In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault. | |
CVE-2026-19884 | | 2026-08-14 | In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first… | |
CVE-2026-15803 | | 2026-08-12 | In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query… | |
CVE-2026-12605 | Critical | 9.6 | 2026-08-06 | In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if th… |
CVE-2026-61891 | High | 7.5 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /f… |
CVE-2026-46581 | High | 7.5 | 2026-08-05 | In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker… |
CVE-2026-60009 | High | 8.8 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The han… |
CVE-2026-14574 | Medium | 6.5 | 2026-08-05 | In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values witho… |
CVE-2026-14304 | Medium | 5.5 | 2026-08-05 | In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versi… |
CVE-2026-12609 | High | 7.5 | 2026-08-05 | In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, w… |
CVE-2026-63252 | High | 7.5 | 2026-08-04 | In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowi… |
CVE-2026-63248 | Medium | 6.5 | 2026-08-04 | In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics o… |
CVE-2026-62927 | High | 7.5 | 2026-08-04 | In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, a… |
CVE-2026-61387 | High | 7.5 | 2026-08-04 | In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server… |
CVE-2026-60007 | High | 7.4 | 2026-08-04 | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentica… |
CVE-2026-58080 | High | 8.2 | 2026-08-04 | In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions… |
CVE-2026-10050 | Critical | 9.1 | 2026-08-04 | In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specifi… |
CVE-2026-18353 | | 2026-07-30 | PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` befo… | |
CVE-2026-15704 | Critical | 9.8 | 2026-07-24 | In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent tr… |
CVE-2026-16441 | Critical | 9.6 | 2026-07-21 | In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is i… |
CVE-2026-16439 | Critical | 9.1 | 2026-07-21 | In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow. |
CVE-2026-16243 | High | 7.5 | 2026-07-21 | In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero. |
CVE-2026-16454 | Medium | 4.3 | 2026-07-21 | In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI… |
CVE-2026-9561 | High | 8.2 | 2026-07-14 | Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log en… |
CVE-2026-8384 | Medium | 5.3 | 2026-07-14 | In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt … |
CVE-2026-6790 | Medium | 5.3 | 2026-07-14 | In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host… |
CVE-2026-57898 | Critical | 9.0 | 2026-07-14 | In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated… |
CVE-2026-15076 | High | 7.5 | 2026-07-14 | In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that… |
CVE-2026-15075 | High | 7.5 | 2026-07-14 | In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers a… |
CVE-2026-13699 | Medium | 4.3 | 2026-07-14 | In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in P… |
CVE-2026-12606 | Medium | 5.3 | 2026-07-14 | Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP… |
CVE-2026-10051 | High | 7.5 | 2026-07-14 | In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Su… |
CVE-2024-7708 | High | 7.5 | 2026-07-14 | For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but… |
CVE-2026-10055 | High | 8.5 | 2026-07-03 | In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /… |
CVE-2026-10054 | High | 8.8 | 2026-07-03 | In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /service… |
CVE-2026-14336 | High | 8.2 | 2026-07-02 | PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py… |
CVE-2026-9563 | High | 7.5 | 2026-07-02 | In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consum… |
CVE-2026-13323 | Medium | 4.1 | 2026-07-01 | In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Poli… |
CVE-2026-12616 | | 2026-06-29 | The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into thr… | |
CVE-2026-9267 | | 2026-06-29 | Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds read vulnerability in the check_server_certificate() function… | |
CVE-2026-4983 | Medium | 4.1 | 2026-06-23 | Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security h… |
CVE-2026-11576 | High | 7.5 | 2026-06-19 | The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this… |
CVE-2026-46580 | High | 8.8 | 2026-06-18 | In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or… |
CVE-2026-44691 | High | 8.8 | 2026-06-18 | In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without re… |
CVE-2026-44688 | High | 8.8 | 2026-06-18 | In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing… |
CVE-2026-22551 | Medium | 6.5 | 2026-06-18 | In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs with… |
CVE-2026-9158 | Critical | 9.8 | 2026-06-18 | In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This… |