Eclipse Foundation vulnerabilities
310 CVEs and advisories name Eclipse Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-114278Unauthenticated Command Injection via kubeconfig Username in che-machine-exec
- CVE-2026-115408ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets
- CVE-2026-113644iofogctl command injection via Controller provisioning response
- CVE-2026-115216Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials
- CVE-2026-89320HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity
- CVE-2026-89319JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic…
- CVE-2026-89318JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)
- CVE-2026-89317JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)
- CVE-2026-89316LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion
- CVE-2026-89315JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix
- CVE-2026-89314Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s
- CVE-2026-89313JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil
- CVE-2026-89312AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV
- CVE-2026-110938JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing
- CVE-2026-111075JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization
- CVE-2026-111074JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()
- CVE-2026-93003NetX Duo Web HTTP server interprets request body content as HTTP header fields
- CVE-2026-95107Module object allocation size overflow corrupts the manager object pool
- CVE-2026-94202Module block-pool create validates two of the four parameter words it reads
- CVE-2026-95108Deleting a user-mode module thread leaks its privileged kernel stack
- CVE-2026-94024Module Manager object lookup validates one byte of a module's search name
- CVE-2026-94023Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion
- CVE-2026-95109Cortex-A7 module data validation checks only the first address of a caller-supplied range
- CVE-2026-94192Module object deallocation can free a live ThreadX kernel object
- CVE-2026-92843Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure
- CVE-2026-92853Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure
- CVE-2026-94018NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path
- CVE-2026-93475Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
- CVE-2026-91057Out-of-bounds read when a multi-line text view string ends with a carriage return
- CVE-2026-92454JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode