Vulnerabilities in Eclipse Foundation
298 resultsCVE-2026-94024MEDIUMModule Manager object lookup validates one byte of a module's search nameEPSS 0.1%CVE-2025-55080HIGHImproper Parameter Check in ThreadX Syscall ImplementationEPSS 0.1%CVE-2026-91189HIGHGUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or themeEPSS 0.1%CVE-2026-115654MEDIUMUser-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not ownEPSS 0.1%CVE-2026-94023MEDIUMModule delete dispatchers do not enforce kernel-object ownership before irreversible deletionEPSS 0.1%CVE-2026-0648HIGHThe vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layersEPSS 0.1%CVE-2026-102730HIGHOut-of-bounds Write via NAND Metadata Parsing at Mount in LevelXEPSS 0.1%CVE-2026-102729MEDIUM`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with EPSS 0.1%CVE-2026-115231HIGHUser-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilegeEPSS 0.1%CVE-2026-86836HIGHIn Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictaEPSS 0.1%CVE-2026-118052MEDIUMModule Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operationEPSS 0.1%CVE-2026-113421HIGHThreadX Modules invokes trace-full callbacks after module unloadEPSS 0.1%CVE-2026-102757HIGHAn unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode,EPSS 0.1%CVE-2026-102709HIGHIn Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereferEPSS 0.1%CVE-2026-19864MEDIUMEclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintexEPSS 0.1%CVE-2026-102710HIGHIn Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a user-mode, memory-protecEPSS 0.1%CVE-2026-115408MEDIUMML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secretsEPSS 0.1%CVE-2026-102711MEDIUMOut-of-bounds Read and Unverified Entry Pointers in the ThreadX Module LoaderEPSS 0.1%