Vulnerabilities in Eclipse Foundation
298 resultsCVE-2025-1471HIGHEclipse OMR: Buffer overflow vulnerabilityEPSS 0.2%CVE-2026-82955CRITICALIn the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API GaEPSS 0.2%CVE-2025-55078MEDIUMIncomplete validation of kernel object pointers in system callsEPSS 0.2%CVE-2025-55079MEDIUMMissing check for thread priorityEPSS 0.2%CVE-2025-1470MEDIUMEclipse OMR: Null pointer dereference vulnerabilityEPSS 0.2%CVE-2026-89320HIGHHmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrityEPSS 0.2%CVE-2026-102758HIGHThe `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitivEPSS 0.2%CVE-2026-95108MEDIUMDeleting a user-mode module thread leaks its privileged kernel stackEPSS 0.2%CVE-2026-96406MEDIUMVIDEO class descriptor walk consumes device-controlled wTotalLength as its boundEPSS 0.2%CVE-2026-96582MEDIUMOut-of-bounds Read via Check-after-use in the USBX HID Report Descriptor ParserEPSS 0.2%CVE-2025-55095MEDIUMThe function _ux_host_class_storage_media_mount() is responsible for mounting partitions on a USB mass storage device. When it encounters anEPSS 0.2%CVE-2026-88819MEDIUMIn Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.EPSS 0.2%CVE-2025-55096LOWInadequate bounds check and potential underflow in _ux_host_class_hid_report_descriptor_get()EPSS 0.2%CVE-2026-92610CRITICALImproper limitation of paths in py-aspect-model-loaderEPSS 0.2%CVE-2026-97400MEDIUMjdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)EPSS 0.2%CVE-2026-91041HIGHFileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT imageEPSS 0.2%CVE-2026-84173HIGHIn Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rulEPSS 0.2%CVE-2026-103414HIGHThe GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with indepenEPSS 0.2%CVE-2026-91059MEDIUMJPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation sizeEPSS 0.2%CVE-2026-91186HIGHPNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds writeEPSS 0.2%