Eclipse Foundation vulnerabilities
310 CVEs and advisories name Eclipse Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-46580In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and
- CVE-2026-44688In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context with
- CVE-2026-9158In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dang
- CVE-2026-2586An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console.
- CVE-2026-2587A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish ga
- CVE-2026-6860A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name
- CVE-2026-7412In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination UR
- CVE-2026-7411In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unau
- CVE-2026-6918In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.
- CVE-2026-6272A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream
- CVE-2026-2332HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
- CVE-2026-5795In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
- CVE-2026-24457An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ
- CVE-2026-1605In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with
- CVE-2025-11143The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs.
- CVE-2026-22886OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication.
- CVE-2026-1699In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while ch
- CVE-2026-1188In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor featur
- CVE-2026-0648The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers
- CVE-2025-55095The function _ux_host_class_storage_media_mount() is responsible for mounting partitions on a USB mass storage device.
- CVE-2025-55102A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo.
- CVE-2025-2515Bluechi: privilege escalation in bluechi via unrestricted cross-node systemd dependencies
- CVE-2025-10543In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly
- CVE-2025-12383Race Condition allows Bypass of Trust Restrictions
- CVE-2025-11965In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to
- CVE-2025-11966In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted in
- CVE-2025-55086In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked ind
- CVE-2025-55085Web http client: Unchecked Server-Side Malicious Packet Issue
- CVE-2025-55087In NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an out-of-bound read by a
- CVE-2025-55100Potential out-of-bounds read in _ux_host_class_audio10_sam_parse_func()