Vulnerabilidades en Eclipse Foundation
298 resultadosCVE-2026-9561HIGHEclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP addrEPSS 0.3%CVE-2026-89312MEDIUMAesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IVEPSS 0.3%CVE-2026-110724HIGHIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from tEPSS 0.3%CVE-2026-102460HIGHIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in EcliEPSS 0.3%CVE-2026-84736HIGHIn the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disablesEPSS 0.3%CVE-2026-9267MEDIUMEclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds read vulnerability in the check_server_cerEPSS 0.3%CVE-2025-55097LOWPotential out-of-bounds read in _ux_host_class_audio_streaming_sampling_get()EPSS 0.3%CVE-2025-6705HIGHA vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. SpecifEPSS 0.3%CVE-2026-92877HIGHThe JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP EPSS 0.3%CVE-2026-102717HIGHMQTT WebSocket setter ABI mismatch may disclose memory or cause a crashEPSS 0.3%CVE-2026-63248MEDIUMIn Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can eEPSS 0.3%CVE-2026-102475HIGHIn Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that reEPSS 0.3%CVE-2026-102467HIGHIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not definEPSS 0.3%CVE-2024-9343MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting
attacks in the Administration Console.EPSS 0.3%CVE-2026-102721MEDIUMTFTP client and server copy the ERROR packet message without bounding the read against the packetEPSS 0.3%CVE-2026-102713HIGHUnbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stallEPSS 0.3%CVE-2026-102712MEDIUMOut-of-bounds read in the NetX Secure DTLS ClientHello parserEPSS 0.3%CVE-2026-102716HIGHA malformed Session header permanently orphans one packet-pool block per RTSP requestEPSS 0.3%CVE-2026-102761CRITICALNetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the lEPSS 0.3%CVE-2026-89315MEDIUMJwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffixEPSS 0.3%