Vulnerabilidades en Eclipse Foundation
298 resultadosCVE-2026-89314MEDIUMQuadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 sEPSS 0.4%CVE-2026-58080HIGHIn Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely oEPSS 0.4%CVE-2024-9202MEDIUMEDC DataSetResolver policy filtering missingEPSS 0.4%CVE-2026-106465MEDIUMMissing HelloVerifyRequest cookie validation in the NetX Secure DTLS serverEPSS 0.4%CVE-2026-111075HIGHJITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserializationEPSS 0.4%CVE-2025-55090MEDIUMPotential out of bound read issue in _nx_ipv4_packet_receive() in NetX DuoEPSS 0.4%CVE-2025-55091MEDIUMPotential out of bound read in _nx_ip_packet_receive()EPSS 0.4%CVE-2025-55081MEDIUMPotential out of bound read in _nx_secure_tls_process_clienthello()EPSS 0.4%CVE-2026-114408HIGHNULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is fullEPSS 0.4%CVE-2026-107597MEDIUMjwks_uri from the OIDC discovery document is fetched without checking its origin or schemeEPSS 0.4%CVE-2026-16454MEDIUMPrivilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware ExfiltrationEPSS 0.4%CVE-2026-89313MEDIUMJwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nilEPSS 0.3%CVE-2026-9563HIGHIn Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number oEPSS 0.3%CVE-2026-76182MEDIUMIn Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, wheEPSS 0.3%CVE-2025-55099LOWPotential out-of-bounds read in _ux_host_class_audio_alternate_setting_locate()EPSS 0.3%CVE-2026-84197CRITICALIn Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and oEPSS 0.3%CVE-2026-118489HIGHCachingWebClient shares user-specific HTTP responses across users via the shared cache tierEPSS 0.3%CVE-2026-82180CRITICALIn Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFiEPSS 0.3%CVE-2024-9408HIGHIn Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.EPSS 0.3%CVE-2024-2214HIGHMissing array size check in _Mtxinit() in the Xtensa portEPSS 0.3%