Eclipse Foundation vulnerabilities
310 CVEs and advisories name Eclipse Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-111729In Kura versions <= 5.6.2, the "Command" file-upload handler at `POST /admin/denali/file/command` extracts a client-supplied ZIP archive…
- CVE-2026-97401In Kura versions <= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the…
- CVE-2026-112186In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no…
- CVE-2026-112185In Eclipse Kura versions 5.1.0 through 5.6.2, the Configuration REST API v2 (org.eclipse.kura.rest.configuration.provider) does not…
- CVE-2026-97891In Eclipse Kura version 5.0.0 to 5.6.2, the Web Console allocates a new HTTP session for every request to its built-in authentication…
- CVE-2026-97402In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of…
- CVE-2026-112191In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by…
- CVE-2026-113422In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1…
- CVE-2026-114359Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives.
- CVE-2026-124683Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in…
- CVE-2026-118492In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in…
- CVE-2026-123870[Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when…
- CVE-2026-123059Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
- CVE-2026-123047Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
- CVE-2026-120421Reflected XSS via client window id in URL client window mode
- CVE-2026-118487Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser
- CVE-2026-118488Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client
- CVE-2026-118489CachingWebClient shares user-specific HTTP responses across users via the shared cache tier
- CVE-2026-89295Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter
- CVE-2026-89293Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering
- CVE-2026-89292Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures
- CVE-2026-92610Improper limitation of paths in py-aspect-model-loader
- CVE-2026-113421ThreadX Modules invokes trace-full callbacks after module unload
- CVE-2026-115231User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
- CVE-2026-115215NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams…
- CVE-2026-115403NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full
- CVE-2026-115654User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own
- CVE-2026-115653Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode
- CVE-2026-114408NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full
- CVE-2026-118052Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation