Eclipse - vulnerabilities (CVEs)

314 CVEs in 76 products, 15 in the last 30 days, newest from 2026-10-15.

Products

Jetty - 52 CVEs
Vert.x - 27 CVEs
Mosquitto - 26 CVEs
Openj9 - 23 CVEs
Threadx Netx Duo - 21 CVEs
Theia - 15 CVEs
Glassfish - 13 CVEs
Threadx Usbx - 10 CVEs
Milo - 7 CVEs
Omr - 7 CVEs
Jetty.project - 6 CVEs
Kura - 6 CVEs
Threadx - 6 CVEs
Californium - 4 CVEs
Che - 4 CVEs
Cyclone Data Distribution Service - 4 CVEs
Eclipse Ide - 4 CVEs
Mojarra - 4 CVEs
Open Vsx - 4 CVEs
Business Intelligence And Reporting Tools - 3 CVEs
Equinox - 3 CVEs
Hawkbit - 3 CVEs
Hono - 3 CVEs
Jgit - 3 CVEs
Memory Analyzer - 3 CVEs
Vert.x-web - 3 CVEs
Wakaama - 3 CVEs
Cyclonedds - 2 CVEs
Eclipse Dataspace Components - 2 CVEs
Jersey - 2 CVEs
Keti - 2 CVEs
Lemminx - 2 CVEs
Openmq - 2 CVEs
Parsson - 2 CVEs
Rdf4j - 2 CVEs
Tinydtls - 2 CVEs
Wild Web Developer - 2 CVEs
4diac Forte - 1 CVEs
Accessibility Tools Framework - 1 CVEs
Angus Mail - 1 CVEs
Birt - 1 CVEs
Buildship - 1 CVEs
Deeplearning4j - 1 CVEs
Ditto - 1 CVEs
Edc Connector - 1 CVEs
Egit - 1 CVEs
Equinox P2 - 1 CVEs
Grizzly - 1 CVEs
Hudson - 1 CVEs
Ide - 1 CVEs
Jakarta Expression Language - 1 CVEs
Jakarta Mail - 1 CVEs
Kuksa - 1 CVEs
Leshan - 1 CVEs
Lyo - 1 CVEs
Org.eclipse.core.runtime - 1 CVEs
Paho Java Client - 1 CVEs
Paho Mqtt - 1 CVEs
Paho Mqtt C/c++ Client - 1 CVEs
Pde - 1 CVEs
Platform - 1 CVEs
Remote Application Platform - 1 CVEs
Sphinx - 1 CVEs
Target Management - 1 CVEs
Theia Website - 1 CVEs
Threadx Filex - 1 CVEs
Vert.x Stomp - 1 CVEs
Vorto - 1 CVEs
Web Tools Platform - 1 CVEs
Xtend - 1 CVEs
Xtext - 1 CVEs
Equinox Osgi - 0 CVEs
Open Message Queue - 0 CVEs
Temurin - 0 CVEs
Vert.x Grpc - 0 CVEs
Xtest - 0 CVEs

Newest CVEs of Eclipse

CVE-2026-102477 - CVSS 8.7 (high), 2026-10-15: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum…
CVE-2026-102464 - CVSS 8.2 (high), 2026-10-15: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every…
CVE-2026-102461 - CVSS 8.7 (high), 2026-10-15: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise…
CVE-2026-103224 - CVSS 8.2 (high), 2026-10-15: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet…
CVE-2026-103223 - CVSS 8.2 (high), 2026-10-15: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message…
CVE-2026-102466 - CVSS 8.2 (high), 2026-10-15: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an…
CVE-2026-102463 - CVSS 8.2 (high), 2026-10-15: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client…
CVE-2026-102469 - CVSS 9.2 (critical), 2026-10-15: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA…
CVE-2026-102462 - CVSS 8.2 (high), 2026-10-15: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client…
CVE-2026-102465 - CVSS 8.2 (high), 2026-10-15: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a…
CVE-2026-102475 - CVSS 8.7 (high), 2026-10-15: In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max…
CVE-2026-102467 - CVSS 8.7 (high), 2026-10-15: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number…
CVE-2026-102471 - CVSS 6.9 (medium), 2026-10-14: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n)…
CVE-2026-102479 - CVSS 8.7 (high), 2026-10-14: In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers,…
CVE-2026-102460 - CVSS 8.6 (high), 2026-10-14: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's…
CVE-2026-12605 - CVSS 9.6 (critical), 2026-08-06: In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if…
CVE-2026-46581 - CVSS 7.5 (high), 2026-08-05: In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an…
CVE-2026-61891 - CVSS 7.5 (high), 2026-08-05: In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT…
CVE-2026-60009 - CVSS 8.8 (high), 2026-08-05: In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The…
CVE-2026-12609 - CVSS 7.5 (high), 2026-08-05: In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint,…
CVE-2026-14574 - CVSS 6.5 (medium), 2026-08-05: In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values…
CVE-2026-14304 - CVSS 5.5 (medium), 2026-08-05: In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker…
CVE-2026-63248 - CVSS 6.9 (medium), 2026-08-04: In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics…
CVE-2026-58080 - CVSS 8.8 (high), 2026-08-04: In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions…
CVE-2026-63252 - CVSS 8.7 (high), 2026-08-04: In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects,…
CVE-2026-62927 - CVSS 8.7 (high), 2026-08-04: In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization,…
CVE-2026-60007 - CVSS 9.1 (critical), 2026-08-04: In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other…
CVE-2026-61387 - CVSS 7.5 (high), 2026-08-04: In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the…
CVE-2026-10050 - CVSS 9.1 (critical), 2026-08-04: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial…
CVE-2026-16441 - CVSS 9.6 (critical), 2026-07-21: In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is…