Vulnerabilidades en Eclipse Foundation
298 resultadosCVE-2026-89295HIGHUnauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameterEPSS 0.2%CVE-2026-123059HIGHKeycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm ChartsEPSS 0.2%CVE-2026-120421MEDIUMReflected XSS via client window id in URL client window modeEPSS 0.2%CVE-2026-123047HIGHKeycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm ChartsEPSS 0.2%CVE-2026-103416CRITICALOut-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message EPSS 0.2%CVE-2025-2515HIGHBluechi: privilege escalation in bluechi via unrestricted cross-node systemd dependenciesEPSS 0.2%CVE-2024-3933MEDIUMEclipse Open J9 With -Xgc:concurrentScavenge on IBM Z, could write/read outside of a bufferEPSS 0.2%CVE-2026-106464HIGHOut-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsingEPSS 0.2%CVE-2026-89316MEDIUMLoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertionEPSS 0.2%CVE-2026-89319MEDIUMJweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocationEPSS 0.2%CVE-2026-102719MEDIUMNetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability checkEPSS 0.2%CVE-2026-102760HIGHWhen NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. BEPSS 0.2%CVE-2026-102762HIGHThe NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of pacEPSS 0.2%CVE-2026-15076HIGHIn versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client doesEPSS 0.2%CVE-2026-15075HIGHIn Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates alEPSS 0.2%CVE-2026-110726MEDIUMIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from tEPSS 0.2%CVE-2024-10031MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting
attacks by modifying the configuration file in the unEPSS 0.2%CVE-2026-96402MEDIUMUSBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle countEPSS 0.2%CVE-2026-113644MEDIUMiofogctl command injection via Controller provisioning responseEPSS 0.2%CVE-2025-11143LOWThe Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs EPSS 0.2%