Vulnerabilidades en Eclipse Foundation

298 resultados
CVE-2026-82958HIGHIn Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command byEPSS 0.4%CVE-2026-18659MEDIUMUnauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substringEPSS 0.4%CVE-2024-4536MEDIUMEclipse EDC: OAuth2 Credential Exfiltration VulnerabilityEPSS 0.4%CVE-2023-5676MEDIUMEclipse OpenJ9 possible infinite busy hangEPSS 0.4%CVE-2025-55094MEDIUMPotential out-of-bounds read in _nx_icmpv6_validate_options()EPSS 0.4%CVE-2026-44691HIGHIn Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be EPSS 0.4%CVE-2024-8642MEDIUMEclipse EDC: Consumer pull transfer token validation checks not appliedEPSS 0.4%CVE-2026-113619HIGHEclipse ioFog renders request templates before authenticationEPSS 0.4%CVE-2025-55102HIGHA denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network pEPSS 0.4%CVE-2026-10055HIGHIn Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connecteEPSS 0.4%CVE-2026-84175MEDIUMIn Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API useEPSS 0.4%CVE-2026-94018HIGHNetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow pathEPSS 0.4%CVE-2026-14574MEDIUMIn Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges prefEPSS 0.4%CVE-2026-13699MEDIUMDatabroker 0.6.1 PublishValue missing data_point panicEPSS 0.4%CVE-2026-102461HIGHIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an EPSS 0.4%CVE-2023-4218MEDIUMXXE in eclipse.platform / Eclipse IDEEPSS 0.4%CVE-2026-18662MEDIUMIn Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same httpEPSS 0.4%CVE-2026-76184HIGHIn Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the rEPSS 0.4%CVE-2026-86590MEDIUMIn Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied EPSS 0.4%CVE-2026-89314MEDIUMQuadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 sEPSS 0.4%