Vulnerabilidades em Eclipse Foundation

298 resultados
Análise Vexday

Com 104 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Eclipse Foundation apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em ambiente real. Ainda assim, 9 vulnerabilidades de severidade crítica e 16 surgidas nos últimos 90 dias indicam ritmo de descoberta que exige atenção contínua. O CVE-2024-10525 se destaca como a falha de maior risco ativo, com escore EPSS de 0,579 — valor que aponta probabilidade relevante de exploração a curto prazo e deve ser tratado com prioridade nos ciclos de correção. A predominância de CWE-125 (leitura fora dos limites do buffer) como tipo de falha mais frequente sinaliza que revisões de segurança de memória em componentes nativos merecem atenção estrutural no processo de desenvolvimento.

CVE-2026-86671HIGHIn Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled EPSS 0.3%CVE-2025-55083MEDIUMBroken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()EPSS 0.3%CVE-2025-55082MEDIUMPotential out of bound read and info leak in_nx_secure_tls_psk_identity_find()EPSS 0.3%CVE-2026-89318MEDIUMJweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)EPSS 0.2%CVE-2026-93475CRITICALOut-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509EPSS 0.2%CVE-2026-102728MEDIUMOut-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)EPSS 0.2%CVE-2025-10543MEDIUMIn Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly EPSS 0.2%CVE-2024-10032MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.EPSS 0.2%CVE-2026-102722MEDIUMThe FTP client trusts arbitrary IP addresses in the PASV server responseEPSS 0.2%CVE-2026-102727MEDIUMFTP Passive Data Connection Not Bound to the Authenticated Control PeerEPSS 0.2%CVE-2026-6860MEDIUMA TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard nameEPSS 0.2%CVE-2026-115216CRITICALEclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentialsEPSS 0.2%CVE-2026-102465HIGHIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allEPSS 0.2%CVE-2024-10029MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.EPSS 0.2%CVE-2026-14304MEDIUMIn Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based applicatEPSS 0.2%CVE-2026-19884HIGHIn Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trustEPSS 0.2%CVE-2026-102476CRITICALIn Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiencyEPSS 0.2%CVE-2025-4447HIGHBuffer Overflow in Eclipse OpenJ9EPSS 0.2%CVE-2026-10054HIGHIn affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shellEPSS 0.2%CVE-2026-89317MEDIUMJwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)EPSS 0.2%