Eclipse Foundation Eclipse Csi - Pia
3 CVEs affecting Eclipse Foundation Eclipse Csi - Pia. Latest disclosed: 2026-07-30. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14336 | High | 8.2 | 2026-07-02 | PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py… |
CVE-2026-18353 | | 2026-07-30 | PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` befo… | |
CVE-2026-12616 | | 2026-06-29 | The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into thr… |