Eclipse Glassfish (Eclipse Foundation) - vulnerabilities (CVEs)
12 CVEs, 0 in the last 30 days, 6 known versions, newest CVE from 2026-08-06. Vendor: Eclipse Foundation.
CVEs of Eclipse Glassfish
- CVE-2026-12605 - CVSS 9.6 (critical), 2026-08-06: In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if…
- CVE-2026-12606 - CVSS 6.3 (medium), 2026-07-14: Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP…
- CVE-2026-2587 - CVSS 9.6 (critical), 2026-05-19: A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The…
- CVE-2026-2586 - CVSS 9.1 (critical), 2026-05-19: An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send…
- CVE-2026-24457 - CVSS 9.8 (critical), 2026-03-05: An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server.…
- CVE-2024-9408 - CVSS 9.8 (critical), 2025-07-16: In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.
- CVE-2024-9342 - CVSS 9.8 (critical), 2025-07-16: In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login…
- CVE-2024-10032 - CVSS 6.1 (medium), 2025-07-16: In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.
- CVE-2024-10031 - CVSS 5.8 (medium), 2025-07-16: In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating…
- CVE-2024-9343 - CVSS 6.1 (medium), 2025-07-16: In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.
- CVE-2024-10029 - CVSS 6.1 (medium), 2025-07-16: In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.
- CVE-2024-8646 - CVSS 6.1 (medium), 2024-09-11: In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability…
