Vulnerabilidades em Eclipse Foundation

298 resultados
Análise Vexday

Com 104 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Eclipse Foundation apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em ambiente real. Ainda assim, 9 vulnerabilidades de severidade crítica e 16 surgidas nos últimos 90 dias indicam ritmo de descoberta que exige atenção contínua. O CVE-2024-10525 se destaca como a falha de maior risco ativo, com escore EPSS de 0,579 — valor que aponta probabilidade relevante de exploração a curto prazo e deve ser tratado com prioridade nos ciclos de correção. A predominância de CWE-125 (leitura fora dos limites do buffer) como tipo de falha mais frequente sinaliza que revisões de segurança de memória em componentes nativos merecem atenção estrutural no processo de desenvolvimento.

CVE-2026-9561HIGHEclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP addrEPSS 0.3%CVE-2026-89312MEDIUMAesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IVEPSS 0.3%CVE-2026-110724HIGHIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from tEPSS 0.3%CVE-2026-102460HIGHIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in EcliEPSS 0.3%CVE-2026-84736HIGHIn the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disablesEPSS 0.3%CVE-2026-9267MEDIUMEclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds read vulnerability in the check_server_cerEPSS 0.3%CVE-2025-55097LOWPotential out-of-bounds read in _ux_host_class_audio_streaming_sampling_get()EPSS 0.3%CVE-2025-6705HIGHA vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. SpecifEPSS 0.3%CVE-2026-92877HIGHThe JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP EPSS 0.3%CVE-2026-102717HIGHMQTT WebSocket setter ABI mismatch may disclose memory or cause a crashEPSS 0.3%CVE-2026-63248MEDIUMIn Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can eEPSS 0.3%CVE-2026-102475HIGHIn Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that reEPSS 0.3%CVE-2026-102467HIGHIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not definEPSS 0.3%CVE-2024-9343MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.EPSS 0.3%CVE-2026-102721MEDIUMTFTP client and server copy the ERROR packet message without bounding the read against the packetEPSS 0.3%CVE-2026-102713HIGHUnbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stallEPSS 0.3%CVE-2026-102712MEDIUMOut-of-bounds read in the NetX Secure DTLS ClientHello parserEPSS 0.3%CVE-2026-102716HIGHA malformed Session header permanently orphans one packet-pool block per RTSP requestEPSS 0.3%CVE-2026-102761CRITICALNetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the lEPSS 0.3%CVE-2026-89315MEDIUMJwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffixEPSS 0.3%