Vulnerabilidades en Eclipse Foundation
298 resultadosCVE-2026-9158MEDIUMIn Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangEPSS 0.6%CVE-2023-7272HIGHEclipse Parsson stack overflow with deeply nested objectsEPSS 0.6%CVE-2026-63252HIGHIn Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel EPSS 0.6%CVE-2024-8391MEDIUMEclipse Vert.x gRPC server does not limit the maximum message sizeEPSS 0.6%CVE-2024-3046HIGHIn Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unautheEPSS 0.6%CVE-2025-55100LOWPotential out-of-bounds read in _ux_host_class_audio10_sam_parse_func()EPSS 0.6%CVE-2026-46581HIGHIn Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, aEPSS 0.6%CVE-2026-60007CRITICALIn Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding aEPSS 0.6%CVE-2026-1699CRITICALIn the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while chEPSS 0.6%CVE-2024-13009HIGHEclipse Jetty GZIP buffer releaseEPSS 0.5%CVE-2026-86464CRITICALIn the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deploEPSS 0.5%CVE-2024-2212HIGHInteger wraparounds, under-allocations, and heap buffer overflows in Eclipse ThreadX xQueueCreate() and xQueueCreateSet()EPSS 0.5%CVE-2026-12616MEDIUMThe /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates tEPSS 0.5%CVE-2026-5795HIGHIn Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning froEPSS 0.5%CVE-2026-78299CRITICALIn Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract fEPSS 0.5%CVE-2026-16441MEDIUMEclipse OpenJ9 : Method resolution default method precedence failureEPSS 0.5%CVE-2026-61891HIGHIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GEEPSS 0.5%CVE-2026-16243MEDIUMEclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zeroEPSS 0.5%CVE-2026-6918HIGHIn Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.EPSS 0.5%CVE-2025-1007MEDIUMImproper Authorization in /user/namespace/{namespace}/detailsEPSS 0.5%