Vulnerabilities in Eclipse Foundation
298 resultsCVE-2026-7412HIGHIn Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination UREPSS 0.5%CVE-2025-55089CRITICALEclipse ThreadX FileX RAM disk driver buffer overflowEPSS 0.5%CVE-2026-18918CRITICALOAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed defaultEPSS 0.5%CVE-2026-44688HIGHIn Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context withEPSS 0.5%CVE-2026-46580HIGHIn Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded andEPSS 0.5%CVE-2025-11965MEDIUMIn Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails toEPSS 0.5%CVE-2026-19863CRITICALAn unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configureEPSS 0.5%CVE-2024-5165MEDIUMEclipse Ditto User Interface vulnerable to XSS due to Improper Neutralization of InputEPSS 0.5%CVE-2026-1188MEDIUMIn the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor featurEPSS 0.5%CVE-2024-9342MEDIUMIn Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of faEPSS 0.5%CVE-2026-79653MEDIUMIn Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enaEPSS 0.5%CVE-2026-15803HIGHIn Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-baseEPSS 0.5%CVE-2026-80515HIGHIn Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whetEPSS 0.5%CVE-2026-108062MEDIUMPre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loopEPSS 0.5%CVE-2026-15704CRITICALCWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go ComponentsEPSS 0.5%CVE-2026-11576HIGHThe security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanEPSS 0.5%CVE-2026-89293HIGHMissing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tamperingEPSS 0.5%CVE-2026-102469CRITICALIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) coEPSS 0.5%CVE-2026-22886CRITICALOpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires
authentication. However, the product ships with a defaulEPSS 0.5%CVE-2025-55087MEDIUMIn NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an out-of-bound read by aEPSS 0.5%