Vulnerabilidades en Eclipse Foundation
298 resultadosCVE-2026-86671HIGHIn Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled EPSS 0.3%CVE-2025-55083MEDIUMBroken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()EPSS 0.3%CVE-2025-55082MEDIUMPotential out of bound read and info leak in_nx_secure_tls_psk_identity_find()EPSS 0.3%CVE-2026-89318MEDIUMJweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)EPSS 0.2%CVE-2026-93475CRITICALOut-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509EPSS 0.2%CVE-2026-102728MEDIUMOut-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)EPSS 0.2%CVE-2025-10543MEDIUMIn Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly EPSS 0.2%CVE-2024-10032MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting
attacks in the Administration Console.EPSS 0.2%CVE-2026-102722MEDIUMThe FTP client trusts arbitrary IP addresses in the PASV server responseEPSS 0.2%CVE-2026-102727MEDIUMFTP Passive Data Connection Not Bound to the Authenticated Control PeerEPSS 0.2%CVE-2026-6860MEDIUMA TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard nameEPSS 0.2%CVE-2026-115216CRITICALEclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentialsEPSS 0.2%CVE-2026-102465HIGHIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allEPSS 0.2%CVE-2024-10029MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting
attacks in the Administration Console.EPSS 0.2%CVE-2026-14304MEDIUMIn Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based applicatEPSS 0.2%CVE-2026-19884HIGHIn Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trustEPSS 0.2%CVE-2026-102476CRITICALIn Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiencyEPSS 0.2%CVE-2025-4447HIGHBuffer Overflow in Eclipse OpenJ9EPSS 0.2%CVE-2026-10054HIGHIn affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shellEPSS 0.2%CVE-2026-89317MEDIUMJwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)EPSS 0.2%