Eclipse Foundation Eclipse Glassfish
12 CVEs affecting Eclipse Foundation Eclipse Glassfish. Latest disclosed: 2026-08-06. Critical: 6, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-9408 | Critical | 9.8 | 2025-07-16 | In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints. |
CVE-2024-9342 | Critical | 9.8 | 2025-07-16 | In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts… |
CVE-2026-12605 | Critical | 9.6 | 2026-08-06 | In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if th… |
CVE-2026-2587 | Critical | 9.6 | 2026-05-19 | A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The a… |
CVE-2026-2586 | Critical | 9.1 | 2026-05-19 | An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send craft… |
CVE-2026-24457 | Critical | 9.1 | 2026-03-05 | An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A… |
CVE-2024-9343 | Medium | 6.1 | 2025-07-16 | In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console. |
CVE-2024-10029 | Medium | 6.1 | 2025-07-16 | In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console. |
CVE-2024-8646 | Medium | 6.1 | 2024-09-11 | In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (C… |
CVE-2024-10032 | Medium | 5.4 | 2025-07-16 | In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console. |
CVE-2024-10031 | Medium | 5.4 | 2025-07-16 | In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating… |
CVE-2026-12606 | Medium | 5.3 | 2026-07-14 | Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP… |