Eclipse Foundation vulnerabilities
310 CVEs and advisories name Eclipse Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-60007In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding a
- CVE-2026-61387In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecke
- CVE-2026-10050Digest authentication lossy encoding
- CVE-2026-18353Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass
- CVE-2026-15704CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components
- CVE-2026-16441Eclipse OpenJ9 : Method resolution default method precedence failure
- CVE-2026-16243Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero
- CVE-2026-16439Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow
- CVE-2026-16454Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration
- CVE-2024-7708For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.
- CVE-2026-8384In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admi
- CVE-2026-6790In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what p
- CVE-2026-10051In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the
- CVE-2026-12606Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leverag
- CVE-2026-15075In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates al
- CVE-2026-15076In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does
- CVE-2026-9561Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP addr
- CVE-2026-57898In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to
- CVE-2026-13699Databroker 0.6.1 PublishValue missing data_point panic
- CVE-2026-10055In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connecte
- CVE-2026-10054In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell
- CVE-2026-14336PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_k
- CVE-2026-9563In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number o
- CVE-2026-13323In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Co
- CVE-2026-12616The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates t
- CVE-2026-9267Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds read vulnerability in the check_server_cer
- CVE-2026-4983Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml
- CVE-2026-11576The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared clean
- CVE-2026-44691In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g.
- CVE-2026-22551In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary