Eclipse Foundation - vulnerabilities (CVEs)
274 CVEs in 86 products, 104 in the last 30 days, newest from 2026-10-28.
Products
- Netx Duo - 32 CVEs
- Eclipse Vert.x - 20 CVEs
- Eclipse Jetty - 15 CVEs
- Threadx - 14 CVEs
- Eclipse Glassfish - 12 CVEs
- Eclipse Theia - 12 CVEs
- Eclipse Keypont - Gose - 9 CVEs
- Eclipse Threadx - 9 CVEs
- Eclipse Threadx - Netx Duo - 8 CVEs
- Eclipse Openj9 - 7 CVEs
- Eclipse Threadx - Guix - 7 CVEs
- Eclipse Milo - 6 CVEs
- Jetty - 6 CVEs
- Eclipse Csi - Pia - 5 CVEs
- Eclipse Aerios - 4 CVEs
- Eclipse Ankaios - 4 CVEs
- Eclipse Ditto - 4 CVEs
- Eclipse Iofog - 4 CVEs
- Eclipse Omr - 4 CVEs
- Eclipse Threadx - Usbx - 4 CVEs
- Mosquitto - 4 CVEs
- Openj9 - 4 CVEs
- Usbx - 4 CVEs
- Eclipse-threadxnetxduo - 3 CVEs
- Eclipse Che - 3 CVEs
- Eclipse Connected Services Platform - 3 CVEs
- Eclipse Open Vsx - 3 CVEs
- Eclipse Arrowhead - 2 CVEs
- Eclipse Basyx - 2 CVEs
- Eclipse Kuksa - Databroker - 2 CVEs
- Eclipse Openmq - 2 CVEs
- Edc - 2 CVEs
- Glassfish - 2 CVEs
- Guix - 2 CVEs
- Nextx Duo - 2 CVEs
- Open J9 - 2 CVEs
- Parsson - 2 CVEs
- Vert.x - 2 CVEs
- Adoptium Temurin - 1 CVEs
- Bluechi - 1 CVEs
- Eclipse-hawkbithawkbit - 1 CVEs
- Eclipse-threadxlevelxnand Driver - 1 CVEs
- Eclipse-threadxthreadx - 1 CVEs
- Eclipse-threadxthreadx Module Manager Loadable-module Loader - 1 CVEs
- Eclipse 4diac - 1 CVEs
- Eclipse Accessibility Tools Framework Actf - 1 CVEs
- Eclipse Basyx - Java Server Sdk - 1 CVEs
- Eclipse Basyx Aas Web Ui - 1 CVEs
- Eclipse Basyx Go Components - 1 CVEs
- Eclipse Cyclone Dds - 1 CVEs
- Eclipse Data Plane Core - 1 CVEs
- Eclipse Dataspace Components - 1 CVEs
- Eclipse Edc Connector - 1 CVEs
- Eclipse Embedded Cdt Cc Development Tools - 1 CVEs
- Eclipse Iceoryx - 1 CVEs
- Eclipse Ide - 1 CVEs
- Eclipse Jetty - Ee8 - 1 CVEs
- Eclipse Jetty - Ee9 - 1 CVEs
- Eclipse Jgit - 1 CVEs
- Eclipse Keypont - 1 CVEs
- Eclipse Kura - 1 CVEs
- Eclipse Kura Installer - 1 CVEs
- Eclipse Lyo - 1 CVEs
- Eclipse Memory Analyzer Tools.mat - 1 CVEs
- Eclipse Mojarra - 1 CVEs
- Eclipse Open Vsx Registry - 1 CVEs
- Eclipse Openvsx - 1 CVEs
- Eclipse Parsson - 1 CVEs
- Eclipse Rap - 1 CVEs
- Eclipse Rdf4j - 1 CVEs
- Eclipse Sw360 - 1 CVEs
- Eclipse Target Management - 1 CVEs
- Eclipse Theia - Website - 1 CVEs
- Eclipse Threadx - Filex - 1 CVEs
- Eclipse Tinydtls - 1 CVEs
- Filex - 1 CVEs
- Jakarta Mail - 1 CVEs
- Jaxb-ri Core - 1 CVEs
- Jersey - 1 CVEs
- Kura - 1 CVEs
- Netxduo - 1 CVEs
- Open-vsx.org - 1 CVEs
- Openvsx - 1 CVEs
- Org.eclipse.core.runtime - 1 CVEs
- Org.eclipse.pde - 1 CVEs
- Paho.mqtt.golang Go Mqtt V3.1 Library - 1 CVEs
Newest CVEs of Eclipse Foundation
- CVE-2026-114278 - CVSS 9.8 (critical), 2026-10-28: The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and…
- CVE-2026-115408 - CVSS 5.5 (medium), 2026-10-27: In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`,…
- CVE-2026-113644 - CVSS 5.5 (medium), 2026-10-27: In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API…
- CVE-2026-115216 - CVSS 9.1 (critical), 2026-10-27: In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs…
- CVE-2026-89320 - CVSS 8.8 (high), 2026-10-23: `HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE…
- CVE-2026-89319 - CVSS 6.3 (medium), 2026-10-23: `JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated…
- CVE-2026-89318 - CVSS 6.9 (medium), 2026-10-23: `JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library…
- CVE-2026-89317 - CVSS 6.3 (medium), 2026-10-23: gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical…
- CVE-2026-89316 - CVSS 6.3 (medium), 2026-10-23: `LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a…
- CVE-2026-89315 - CVSS 6.9 (medium), 2026-10-23: `JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim.…
- CVE-2026-89314 - CVSS 6.9 (medium), 2026-10-23: `jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry…
- CVE-2026-89313 - CVSS 6.3 (medium), 2026-10-23: `JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not…
- CVE-2026-89312 - CVSS 6.9 (medium), 2026-10-23: `AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than…
- CVE-2026-110938 - CVSS 8.7 (high), 2026-10-21: In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message…
- CVE-2026-111075 - CVSS 8.7 (high), 2026-10-21: In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`,…
- CVE-2026-111074 - CVSS 8.7 (high), 2026-10-21: In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the…
- CVE-2026-93003 - CVSS 6.9 (medium), 2026-10-20: The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name…
- CVE-2026-95107 - CVSS 7 (high), 2026-10-20: A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and…
- CVE-2026-94202 - CVSS 4.8 (medium), 2026-10-20: The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module supplies lay…
- CVE-2026-95108 - CVSS 6.8 (medium), 2026-10-20: One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD`…
- CVE-2026-94024 - CVSS 6.9 (medium), 2026-10-20: The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in…
- CVE-2026-94023 - CVSS 6.9 (medium), 2026-10-20: A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the…
- CVE-2026-95109 - CVSS 8.5 (high), 2026-10-20: The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range…
- CVE-2026-94192 - CVSS 8.5 (high), 2026-10-20: A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with…
- CVE-2026-92843 - CVSS 8.7 (high), 2026-10-20: A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a…
- CVE-2026-92853 - CVSS 8.7 (high), 2026-10-20: The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a…
- CVE-2026-94018 - CVSS 8.8 (high), 2026-10-20: The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request.…
- CVE-2026-93475 - CVSS 9.3 (critical), 2026-10-20: The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for…
- CVE-2026-91057 - CVSS 4.6 (medium), 2026-10-20: `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage…
- CVE-2026-92454 - CVSS 6.8 (medium), 2026-10-20: The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is…
