# cve.now: Eclipse Foundation

The newest entries naming Eclipse Foundation as an affected vendor (up to 200), of 310 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-111729](https://cve.now/CVE-2026-111729.md): In Kura versions \<= 5.6.2, the "Command" file-upload handler at \`POST /admin/denali/file/command\` extracts a client-supplied ZIP archive… (CVSS 7.0)
- [CVE-2026-97401](https://cve.now/CVE-2026-97401.md): In Kura versions \<= 5.6.2, \`CommandCloudApp.execute()\` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the… (CVSS 7.4)
- [CVE-2026-112186](https://cve.now/CVE-2026-112186.md): In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no… (CVSS 8.7)
- [CVE-2026-112185](https://cve.now/CVE-2026-112185.md): In Eclipse Kura versions 5.1.0 through 5.6.2, the Configuration REST API v2 (org.eclipse.kura.rest.configuration.provider) does not… (CVSS 8.6)
- [CVE-2026-97891](https://cve.now/CVE-2026-97891.md): In Eclipse Kura version 5.0.0 to 5.6.2, the Web Console allocates a new HTTP session for every request to its built-in authentication… (CVSS 8.8)
- [CVE-2026-97402](https://cve.now/CVE-2026-97402.md): In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of… (CVSS 2.3)
- [CVE-2026-112191](https://cve.now/CVE-2026-112191.md): In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by… (CVSS 8.6)
- [CVE-2026-113422](https://cve.now/CVE-2026-113422.md): In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1… (CVSS 7.7)
- [CVE-2026-114359](https://cve.now/CVE-2026-114359.md): Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. (CVSS 7.0)
- [CVE-2026-124683](https://cve.now/CVE-2026-124683.md): Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in… (CVSS 8.7)
- [CVE-2026-118492](https://cve.now/CVE-2026-118492.md): In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in… (CVSS 2.0)
- [CVE-2026-123870](https://cve.now/CVE-2026-123870.md): \[Eclipse CSI - otterdog\] Unauthenticated remote code execution via eval() on format-string-injected webhook body when… (CVSS 9.5)
- [CVE-2026-123059](https://cve.now/CVE-2026-123059.md): Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts (CVSS 7.5)
- [CVE-2026-123047](https://cve.now/CVE-2026-123047.md): Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts (CVSS 7.5)
- [CVE-2026-120421](https://cve.now/CVE-2026-120421.md): Reflected XSS via client window id in URL client window mode (CVSS 6.1)
- [CVE-2026-118487](https://cve.now/CVE-2026-118487.md): Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser (CVSS 7.5)
- [CVE-2026-118488](https://cve.now/CVE-2026-118488.md): Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client (CVSS 5.9)
- [CVE-2026-118489](https://cve.now/CVE-2026-118489.md): CachingWebClient shares user-specific HTTP responses across users via the shared cache tier (CVSS 7.5)
- [CVE-2026-89295](https://cve.now/CVE-2026-89295.md): Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter (CVSS 7.5)
- [CVE-2026-89293](https://cve.now/CVE-2026-89293.md): Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering (CVSS 8.8)
- [CVE-2026-89292](https://cve.now/CVE-2026-89292.md): Unauthenticated SSRF with MNESTIX\_BACKEND\_API\_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures (CVSS 9.2)
- [CVE-2026-92610](https://cve.now/CVE-2026-92610.md): Improper limitation of paths in py-aspect-model-loader (CVSS 9.8)
- [CVE-2026-113421](https://cve.now/CVE-2026-113421.md): ThreadX Modules invokes trace-full callbacks after module unload (CVSS 7.3)
- [CVE-2026-115231](https://cve.now/CVE-2026-115231.md): User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege (CVSS 8.5)
- [CVE-2026-115215](https://cve.now/CVE-2026-115215.md): NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams… (CVSS 8.7)
- [CVE-2026-115403](https://cve.now/CVE-2026-115403.md): NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full (CVSS 8.2)
- [CVE-2026-115654](https://cve.now/CVE-2026-115654.md): User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own (CVSS 6.9)
- [CVE-2026-115653](https://cve.now/CVE-2026-115653.md): Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode (CVSS 7.0)
- [CVE-2026-114408](https://cve.now/CVE-2026-114408.md): NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full (CVSS 8.7)
- [CVE-2026-118052](https://cve.now/CVE-2026-118052.md): Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation (CVSS 6.8)
- [CVE-2026-114278](https://cve.now/CVE-2026-114278.md): Unauthenticated Command Injection via kubeconfig Username in che-machine-exec (CVSS 9.8)
- [CVE-2026-115408](https://cve.now/CVE-2026-115408.md): ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets (CVSS 5.5)
- [CVE-2026-113644](https://cve.now/CVE-2026-113644.md): iofogctl command injection via Controller provisioning response (CVSS 5.5)
- [CVE-2026-115216](https://cve.now/CVE-2026-115216.md): Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials (CVSS 9.1)
- [CVE-2026-89320](https://cve.now/CVE-2026-89320.md): HmacShaCryptor.Hash never hashes its input — returns constant HMAC\_K("") for all inputs, voiding CBC-HMAC JWE integrity (CVSS 8.8)
- [CVE-2026-89319](https://cve.now/CVE-2026-89319.md): JweDirectDecryptorBlock.Decrypt: unchecked \_thales\_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic… (CVSS 6.3)
- [CVE-2026-89318](https://cve.now/CVE-2026-89318.md): JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check) (CVSS 6.9)
- [CVE-2026-89317](https://cve.now/CVE-2026-89317.md): JwtVerifierImpl.Verify does not enforce the JWS \`crit\` header (RFC 7515 §4.1.11) (CVSS 6.3)
- [CVE-2026-89316](https://cve.now/CVE-2026-89316.md): LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked \*ECDSAOptions type assertion (CVSS 6.3)
- [CVE-2026-89315](https://cve.now/CVE-2026-89315.md): JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix (CVSS 6.9)
- [CVE-2026-89314](https://cve.now/CVE-2026-89314.md): Quadratic-time key\_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s (CVSS 6.9)
- [CVE-2026-89313](https://cve.now/CVE-2026-89313.md): JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil (CVSS 6.3)
- [CVE-2026-89312](https://cve.now/CVE-2026-89312.md): AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV (CVSS 6.9)
- [CVE-2026-110938](https://cve.now/CVE-2026-110938.md): JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing (CVSS 8.7)
- [CVE-2026-111075](https://cve.now/CVE-2026-111075.md): JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization (CVSS 8.7)
- [CVE-2026-111074](https://cve.now/CVE-2026-111074.md): JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity() (CVSS 8.7)
- [CVE-2026-93003](https://cve.now/CVE-2026-93003.md): NetX Duo Web HTTP server interprets request body content as HTTP header fields (CVSS 6.9)
- [CVE-2026-95107](https://cve.now/CVE-2026-95107.md): Module object allocation size overflow corrupts the manager object pool (CVSS 7.0)
- [CVE-2026-94202](https://cve.now/CVE-2026-94202.md): Module block-pool create validates two of the four parameter words it reads (CVSS 4.8)
- [CVE-2026-95108](https://cve.now/CVE-2026-95108.md): Deleting a user-mode module thread leaks its privileged kernel stack (CVSS 6.8)
- [CVE-2026-94024](https://cve.now/CVE-2026-94024.md): Module Manager object lookup validates one byte of a module's search name (CVSS 6.9)
- [CVE-2026-94023](https://cve.now/CVE-2026-94023.md): Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion (CVSS 6.9)
- [CVE-2026-95109](https://cve.now/CVE-2026-95109.md): Cortex-A7 module data validation checks only the first address of a caller-supplied range (CVSS 8.5)
- [CVE-2026-94192](https://cve.now/CVE-2026-94192.md): Module object deallocation can free a live ThreadX kernel object (CVSS 8.5)
- [CVE-2026-92843](https://cve.now/CVE-2026-92843.md): Out-of-bounds Read via the TLS 1.3 Certificate extensions\_length in NetX Secure (CVSS 8.7)
- [CVE-2026-92853](https://cve.now/CVE-2026-92853.md): Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure (CVSS 8.7)
- [CVE-2026-94018](https://cve.now/CVE-2026-94018.md): NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path (CVSS 8.8)
- [CVE-2026-93475](https://cve.now/CVE-2026-93475.md): Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509 (CVSS 9.3)
- [CVE-2026-91057](https://cve.now/CVE-2026-91057.md): Out-of-bounds read when a multi-line text view string ends with a carriage return (CVSS 4.6)
- [CVE-2026-92454](https://cve.now/CVE-2026-92454.md): JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode (CVSS 6.1)
- [CVE-2026-91059](https://cve.now/CVE-2026-91059.md): JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size (CVSS 6.8)
- [CVE-2026-91189](https://cve.now/CVE-2026-91189.md): GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme (CVSS 7.1)
- [CVE-2026-92446](https://cve.now/CVE-2026-92446.md): GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader (CVSS 6.8)
- [CVE-2026-92449](https://cve.now/CVE-2026-92449.md): Binary resource loader: unbounded map\_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena (CVSS 6.8)
- [CVE-2026-91186](https://cve.now/CVE-2026-91186.md): PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write (CVSS 8.4)
- [CVE-2026-95111](https://cve.now/CVE-2026-95111.md): Module queue front-send validates a word count as a byte count (CVSS 4.8)
- [CVE-2026-96402](https://cve.now/CVE-2026-96402.md): USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count (CVSS 5.2)
- [CVE-2026-97400](https://cve.now/CVE-2026-97400.md): jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader) (CVSS 6.8)
- [CVE-2026-96406](https://cve.now/CVE-2026-96406.md): VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound (CVSS 4.9)
- [CVE-2026-96582](https://cve.now/CVE-2026-96582.md): Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser (CVSS 4.9)
- [CVE-2026-91041](https://cve.now/CVE-2026-91041.md): FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image (CVSS 7.8)
- [CVE-2026-113620](https://cve.now/CVE-2026-113620.md): Eclipse ioFog operator WebSocket accepts an unverified JWT (CVSS 9.8)
- [CVE-2026-113619](https://cve.now/CVE-2026-113619.md): Eclipse ioFog renders request templates before authentication (CVSS 7.5)
- [CVE-2026-107597](https://cve.now/CVE-2026-107597.md): jwks\_uri from the OIDC discovery document is fetched without checking its origin or scheme (CVSS 5.1)
- [CVE-2026-108062](https://cve.now/CVE-2026-108062.md): Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop (CVSS 6.9)
- [CVE-2026-93649](https://cve.now/CVE-2026-93649.md): In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf ( (CVSS 7.5)
- [CVE-2026-110723](https://cve.now/CVE-2026-110723.md): In \`api-gateway\` versions till \`1.7.3\`, The default rate-limit key resolver, \`ClientIpKeyResolver\`, derives the per-client bucket key from t (CVSS 7.5)
- [CVE-2026-110724](https://cve.now/CVE-2026-110724.md): In \`api-gateway\` versions till \`1.7.3\`, The default rate-limit key resolver, \`ClientIpKeyResolver\`, derives the per-client bucket key from t (CVSS 7.5)
- [CVE-2026-110726](https://cve.now/CVE-2026-110726.md): In \`api-gateway\` versions till \`1.7.3\`, The default rate-limit key resolver, \`ClientIpKeyResolver\`, derives the per-client bucket key from t (CVSS 6.5)
- [CVE-2026-18659](https://cve.now/CVE-2026-18659.md): Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring (CVSS 6.9)
- [CVE-2026-18662](https://cve.now/CVE-2026-18662.md): In Eclipse Jetty, across various versions of \`jetty-security\`, and \`jetty-eeN-security\`, two or more security constraints with the same http (CVSS 6.9)
- [CVE-2026-19864](https://cve.now/CVE-2026-19864.md): Eclipse Jetty's \`SessionAuthentication\` retains authentication credentials in a serializable object. (CVSS 5.6)
- [CVE-2026-19863](https://cve.now/CVE-2026-19863.md): An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configure (CVSS 9.3)
- [CVE-2026-18660](https://cve.now/CVE-2026-18660.md): Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames (CVSS 8.8)
- [CVE-2026-18661](https://cve.now/CVE-2026-18661.md): In Eclipse Jetty, across various versions of \`jetty-annotations\`, and \`jetty-eeN-annotations\`, the Jakarta Spec authoritative url-pattern ru (CVSS 8.8)
- [CVE-2026-77711](https://cve.now/CVE-2026-77711.md): When Jetty's \`HttpClient\` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required (CVSS 8.2)
- [CVE-2026-76184](https://cve.now/CVE-2026-76184.md): In Eclipse Jetty, HttpClient may receive a redirect of the form: \`\`\` /secure/../evil \`\`\` If an attacker is able to control the r (CVSS 8.2)
- [CVE-2026-76182](https://cve.now/CVE-2026-76182.md): In Eclipse Jetty, \`TryPathsHandler\` and \`TryFilesFilter\` can be configured to forward requests to template URIs such as \`index?p=$path\`, whe (CVSS 6.9)
- [CVE-2026-102477](https://cve.now/CVE-2026-102477.md): In Eclipse Vert.x versions \[4.0.0, 4.5.34\] or \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], a gRPC endpoint does have a configurable pe (CVSS 8.7)
- [CVE-2026-102464](https://cve.now/CVE-2026-102464.md): In Eclipse Vert.x versions \[4.0.0, 4.5.34\] or \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the Eclipse Vert.x MQTT (vertx-mqtt) MqttCl (CVSS 8.2)
- [CVE-2026-102461](https://cve.now/CVE-2026-102461.md): In Eclipse Vert.x versions \[4.0.0, 4.5.34\] or \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the uniqueItems keyword validation uses an (CVSS 8.7)
- [CVE-2026-103224](https://cve.now/CVE-2026-103224.md): In Eclipse Vert.x versions \[4.0.0, 4.5.34\] or \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the MySQL message decoder aggregates inboun (CVSS 8.2)
- [CVE-2026-103223](https://cve.now/CVE-2026-103223.md): In Eclipse Vert.x versions \[4.0.0, 4.5.34\] or \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the PostgreSQL message decoder reads the 4- (CVSS 8.2)
- [CVE-2026-102466](https://cve.now/CVE-2026-102466.md): In Eclipse Vert.x versions \[4.0.0, 4.5.34\] or \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the Vert.x MySQL client (vertx-mysql-client (CVSS 8.2)
- [CVE-2026-102463](https://cve.now/CVE-2026-102463.md): In Eclipse Vert.x versions \[4.0.0, 4.5.34\] or \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the binary array decoder in vertx-pg-client (CVSS 8.2)
- [CVE-2026-102469](https://cve.now/CVE-2026-102469.md): In Eclipse Vert.x versions \[4.0.0, 4.5.34\] or \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the Vert.x DB2 client (vertx-db2-client) co (CVSS 9.2)
- [CVE-2026-102462](https://cve.now/CVE-2026-102462.md): In Eclipse Vert.x versions \[4.0.0, 4.5.34\] or \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the TDS message decoder in the Vert.x MSSQL (CVSS 8.2)
- [CVE-2026-102465](https://cve.now/CVE-2026-102465.md): In Eclipse Vert.x versions \[4.0.0, 4.5.34\] or \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the Vert.x Redis client RESP parser pre-all (CVSS 8.2)
- [CVE-2026-102475](https://cve.now/CVE-2026-102475.md): In Eclipse Vert.x versions \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the HTTP proxy provides a body transformer interceptor that re (CVSS 8.7)
- [CVE-2026-102467](https://cve.now/CVE-2026-102467.md): In Eclipse Vert.x versions \[4.0.0, 4.5.34\] or \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the WebSocket implementation does not defin (CVSS 8.7)
- [CVE-2026-102471](https://cve.now/CVE-2026-102471.md): CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages (CVSS 6.9)
- [CVE-2026-102479](https://cve.now/CVE-2026-102479.md): In Eclipse Vert.x versions \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the Vert.x HTTP/1.x decoder uses a canonicalization for well k (CVSS 8.7)
- [CVE-2026-102460](https://cve.now/CVE-2026-102460.md): In Eclipse Vert.x versions \[4.0.0, 4.5.34\] or \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], a scope bypass vulnerability exists in Ecli (CVSS 8.6)
- [CVE-2026-102476](https://cve.now/CVE-2026-102476.md): In Eclipse Vert.x versions \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the Vert.x HTTP client relies on an SSL context for efficiency (CVSS 9.1)
- [CVE-2026-106465](https://cve.now/CVE-2026-106465.md): Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server (CVSS 6.9)
- [CVE-2026-106464](https://cve.now/CVE-2026-106464.md): Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing (CVSS 8.7)
- [CVE-2026-103415](https://cve.now/CVE-2026-103415.md): When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the coo (CVSS 9.3)
- [CVE-2026-103414](https://cve.now/CVE-2026-103414.md): The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with indepen (CVSS 8.4)
- [CVE-2026-92877](https://cve.now/CVE-2026-92877.md): The JAXB factory methods historically relied solely on \`FEATURE\_SECURE\_PROCESSING\` to prevent XML External Entity (XXE) resolution. (CVSS 8.3)
- [CVE-2026-103416](https://cve.now/CVE-2026-103416.md): Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message (CVSS 9.3)
- [CVE-2026-86671](https://cve.now/CVE-2026-86671.md): In Eclipse Che versions 7.29.0 and later, the GET \`/api/scm/resolve\` and \`POST /api/factory/resolver\` endpoints pass an attacker-controlled (CVSS 8.4)
- [CVE-2026-101322](https://cve.now/CVE-2026-101322.md): In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastru (CVSS 8.3)
- [CVE-2026-102717](https://cve.now/CVE-2026-102717.md): MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash (CVSS 7.5)
- [CVE-2026-102730](https://cve.now/CVE-2026-102730.md): Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX (CVSS 8.6)
- [CVE-2026-102729](https://cve.now/CVE-2026-102729.md): \`gx\_binres\_theme\_load()\` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with (CVSS 5.9)
- [CVE-2026-102727](https://cve.now/CVE-2026-102727.md): FTP Passive Data Connection Not Bound to the Authenticated Control Peer (CVSS 6.0)
- [CVE-2026-102728](https://cve.now/CVE-2026-102728.md): Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest) (CVSS 6.3)
- [CVE-2026-102726](https://cve.now/CVE-2026-102726.md): Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read (CVSS 7.1)
- [CVE-2026-102725](https://cve.now/CVE-2026-102725.md): Out-of-bounds Read from Unvalidated MSRP Attribute List Length (CVSS 7.1)
- [CVE-2026-102724](https://cve.now/CVE-2026-102724.md): NULL pointer dereference when evicting the last MSRP attribute in a participant's list (CVSS 7.1)
- [CVE-2026-102723](https://cve.now/CVE-2026-102723.md): NULL Pointer Dereference on MSRP Attribute Table Exhaustion (CVSS 7.1)
- [CVE-2026-102722](https://cve.now/CVE-2026-102722.md): The FTP client trusts arbitrary IP addresses in the PASV server response (CVSS 6.9)
- [CVE-2026-102721](https://cve.now/CVE-2026-102721.md): TFTP client and server copy the ERROR packet message without bounding the read against the packet (CVSS 6.9)
- [CVE-2026-102720](https://cve.now/CVE-2026-102720.md): DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer (CVSS 5.3)
- [CVE-2026-102719](https://cve.now/CVE-2026-102719.md): NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check (CVSS 6.3)
- [CVE-2026-102718](https://cve.now/CVE-2026-102718.md): Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length (CVSS 8.7)
- [CVE-2026-102716](https://cve.now/CVE-2026-102716.md): A malformed Session header permanently orphans one packet-pool block per RTSP request (CVSS 8.7)
- [CVE-2026-102715](https://cve.now/CVE-2026-102715.md): mDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packet (CVSS 7.1)
- [CVE-2026-102714](https://cve.now/CVE-2026-102714.md): ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement… (CVSS 7.1)
- [CVE-2026-102713](https://cve.now/CVE-2026-102713.md): Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall (CVSS 8.3)
- [CVE-2026-102712](https://cve.now/CVE-2026-102712.md): Out-of-bounds read in the NetX Secure DTLS ClientHello parser (CVSS 6.3)
- [CVE-2026-102711](https://cve.now/CVE-2026-102711.md): Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader (CVSS 6.9)
- [CVE-2026-102710](https://cve.now/CVE-2026-102710.md): In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX\_ENABLE\_EVENT\_TRACE, the Module Manager lets a user-mode… (CVSS 8.5)
- [CVE-2026-102709](https://cve.now/CVE-2026-102709.md): In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports… (CVSS 8.4)
- [CVE-2026-102762](https://cve.now/CVE-2026-102762.md): The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. (CVSS 8.2)
- [CVE-2026-102761](https://cve.now/CVE-2026-102761.md): NetX Duo's WebSocket client resets the unmasking cursor to the first \`NX\_PACKET\` each time it advances through a chained packet, while the l (CVSS 9.3)
- [CVE-2026-102760](https://cve.now/CVE-2026-102760.md): When NetX Secure is built with \`NX\_SECURE\_KEY\_CLEAR\`, every TLS record sent on an active session is wiped after it has been handed to TCP. (CVSS 8.3)
- [CVE-2026-102759](https://cve.now/CVE-2026-102759.md): NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. (CVSS 6.3)
- [CVE-2026-102758](https://cve.now/CVE-2026-102758.md): The \`\_nx\_secure\_x509\_asn1\_tlv\_block\_parse()\` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. (CVSS 7.5)
- [CVE-2026-102757](https://cve.now/CVE-2026-102757.md): An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, (CVSS 8.5)
- [CVE-2026-90882](https://cve.now/CVE-2026-90882.md): Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data (CVSS 8.7)
- [CVE-2026-92612](https://cve.now/CVE-2026-92612.md): In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as (CVSS 1.0)
- [CVE-2025-12999](https://cve.now/CVE-2025-12999.md): UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forward (CVSS 9.1)
- [CVE-2026-92611](https://cve.now/CVE-2026-92611.md): In Eclipse Ankaios versions 0.6.0 to before 1.0.4, \`LogRule::matches\` in the agent control-interface authorizer stops at the first wildcard (CVSS 4.8)
- [CVE-2026-86836](https://cve.now/CVE-2026-86836.md): In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predicta (CVSS 8.4)
- [CVE-2026-88819](https://cve.now/CVE-2026-88819.md): In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID. (CVSS 6.3)
- [CVE-2026-78299](https://cve.now/CVE-2026-78299.md): In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract f (CVSS 9.1)
- [CVE-2026-89321](https://cve.now/CVE-2026-89321.md): Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry (CVSS 4.3)
- [CVE-2026-84197](https://cve.now/CVE-2026-84197.md): In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and o (CVSS 9.2)
- [CVE-2026-86464](https://cve.now/CVE-2026-86464.md): In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deplo (CVSS 9.9)
- [CVE-2026-12611](https://cve.now/CVE-2026-12611.md): A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads (CVSS 8.7)
- [CVE-2026-19203](https://cve.now/CVE-2026-19203.md): A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret dif (CVSS 8.3)
- [CVE-2026-86590](https://cve.now/CVE-2026-86590.md): In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied (CVSS 6.3)
- [CVE-2026-19204](https://cve.now/CVE-2026-19204.md): A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory (CVSS 8.7)
- [CVE-2026-85201](https://cve.now/CVE-2026-85201.md): In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf m (CVSS 6.8)
- [CVE-2026-84173](https://cve.now/CVE-2026-84173.md): In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rul (CVSS 8.3)
- [CVE-2026-84736](https://cve.now/CVE-2026-84736.md): In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables (CVSS 8.3)
- [CVE-2026-85199](https://cve.now/CVE-2026-85199.md): Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. (CVSS 8.8)
- [CVE-2026-80515](https://cve.now/CVE-2026-80515.md): In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whet (CVSS 8.9)
- [CVE-2026-82180](https://cve.now/CVE-2026-82180.md): In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFi (CVSS 9.5)
- [CVE-2026-82955](https://cve.now/CVE-2026-82955.md): In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Ga (CVSS 9.0)
- [CVE-2026-82958](https://cve.now/CVE-2026-82958.md): In Eclipse Ditto versions \[1.3.0, 3.9.6\], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by (CVSS 7.6)
- [CVE-2026-84175](https://cve.now/CVE-2026-84175.md): In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API use (CVSS 5.3)
- [CVE-2026-82217](https://cve.now/CVE-2026-82217.md): In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent (CVSS 8.8)
- [CVE-2026-18918](https://cve.now/CVE-2026-18918.md): OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1\_0Allowed default (CVSS 9.1)
- [CVE-2026-79653](https://cve.now/CVE-2026-79653.md): In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key ena (CVSS 6.0)
- [CVE-2026-16440](https://cve.now/CVE-2026-16440.md): In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault. (CVSS 5.7)
- [CVE-2026-19884](https://cve.now/CVE-2026-19884.md): In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust (CVSS 8.4)
- [CVE-2026-15803](https://cve.now/CVE-2026-15803.md): In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-base (CVSS 8.7)
- [CVE-2026-12605](https://cve.now/CVE-2026-12605.md): In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin \`gfresttoken\` to attacker-co (CVSS 9.6)
- [CVE-2026-46581](https://cve.now/CVE-2026-46581.md): In Eclipse Mojarra versions 2.3 and following, URL handing in \`DefaultFaceletFactory\` does not properly sanitize and/or block remote URLs, a (CVSS 7.5)
- [CVE-2026-61891](https://cve.now/CVE-2026-61891.md): In Eclipse Theia versions up to and including 1.73.1, the \`@theia/filesystem\` backend exposes HTTP file-download endpoints (\`GET /file\`, \`GE (CVSS 7.5)
- [CVE-2026-60009](https://cve.now/CVE-2026-60009.md): In Eclipse Theia versions up to and including 1.73.1, the \`@theia/filesystem\` backend binds \`POST /file-upload\` in every filesystem-enabled (CVSS 8.8)
- [CVE-2026-12609](https://cve.now/CVE-2026-12609.md): In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the \`@theia/plugin-ext\` backend exposes the \`/hostedPlugin/:pluginId/:path(\* (CVSS 7.5)
- [CVE-2026-14574](https://cve.now/CVE-2026-14574.md): In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the \`PreferenceUtils.merge\` function in \`@theia/core\` recursively merges pref (CVSS 5.7)
- [CVE-2026-14304](https://cve.now/CVE-2026-14304.md): In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based applicat (CVSS 4.6)
- [CVE-2026-63248](https://cve.now/CVE-2026-63248.md): In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. (CVSS 6.9)
- [CVE-2026-58080](https://cve.now/CVE-2026-58080.md): In Eclipse Milo versions 1.0.0 through 1.1.4, \`OpcUaServerConfig.copy()\` fails to preserve a configured \`RoleMapper\`. (CVSS 8.8)
- [CVE-2026-63252](https://cve.now/CVE-2026-63252.md): In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel (CVSS 8.7)
- [CVE-2026-62927](https://cve.now/CVE-2026-62927.md): In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculati (CVSS 8.7)
- [CVE-2026-60007](https://cve.now/CVE-2026-60007.md): In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding a (CVSS 9.1)
- [CVE-2026-61387](https://cve.now/CVE-2026-61387.md): In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecke (CVSS 6.9)
- [CVE-2026-10050](https://cve.now/CVE-2026-10050.md): Digest authentication lossy encoding (CVSS 8.7)
- [CVE-2026-18353](https://cve.now/CVE-2026-18353.md): Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass (CVSS 8.8)
- [CVE-2026-15704](https://cve.now/CVE-2026-15704.md): CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components (CVSS 9.8)
- [CVE-2026-16441](https://cve.now/CVE-2026-16441.md): Eclipse OpenJ9 : Method resolution default method precedence failure (CVSS 6.9)
- [CVE-2026-16243](https://cve.now/CVE-2026-16243.md): Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero (CVSS 5.7)
- [CVE-2026-16439](https://cve.now/CVE-2026-16439.md): Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow (CVSS 5.8)
- [CVE-2026-16454](https://cve.now/CVE-2026-16454.md): Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration (CVSS 4.3)
- [CVE-2024-7708](https://cve.now/CVE-2024-7708.md): For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. (CVSS 7.5)
- [CVE-2026-8384](https://cve.now/CVE-2026-8384.md): In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admi (CVSS 5.3)
- [CVE-2026-6790](https://cve.now/CVE-2026-6790.md): In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what p (CVSS 5.3)
- [CVE-2026-10051](https://cve.now/CVE-2026-10051.md): In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the (CVSS 6.9)
- [CVE-2026-12606](https://cve.now/CVE-2026-12606.md): Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leverag (CVSS 6.3)
- [CVE-2026-15075](https://cve.now/CVE-2026-15075.md): In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates al (CVSS 8.2)
- [CVE-2026-15076](https://cve.now/CVE-2026-15076.md): In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does (CVSS 8.2)
- [CVE-2026-9561](https://cve.now/CVE-2026-9561.md): Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP addr (CVSS 8.8)
- [CVE-2026-57898](https://cve.now/CVE-2026-57898.md): In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to (CVSS 9.0)
- [CVE-2026-13699](https://cve.now/CVE-2026-13699.md): Databroker 0.6.1 PublishValue missing data\_point panic (CVSS 4.3)
- [CVE-2026-10055](https://cve.now/CVE-2026-10055.md): In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connecte (CVSS 8.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/eclipse-foundation
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.