Vulnerabilidades em Eclipse Foundation

298 resultados
Análise Vexday

Com 104 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Eclipse Foundation apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em ambiente real. Ainda assim, 9 vulnerabilidades de severidade crítica e 16 surgidas nos últimos 90 dias indicam ritmo de descoberta que exige atenção contínua. O CVE-2024-10525 se destaca como a falha de maior risco ativo, com escore EPSS de 0,579 — valor que aponta probabilidade relevante de exploração a curto prazo e deve ser tratado com prioridade nos ciclos de correção. A predominância de CWE-125 (leitura fora dos limites do buffer) como tipo de falha mais frequente sinaliza que revisões de segurança de memória em componentes nativos merecem atenção estrutural no processo de desenvolvimento.

CVE-2026-89295HIGHUnauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameterEPSS 0.2%CVE-2026-123059HIGHKeycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm ChartsEPSS 0.2%CVE-2026-120421MEDIUMReflected XSS via client window id in URL client window modeEPSS 0.2%CVE-2026-123047HIGHKeycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm ChartsEPSS 0.2%CVE-2026-103416CRITICALOut-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message EPSS 0.2%CVE-2025-2515HIGHBluechi: privilege escalation in bluechi via unrestricted cross-node systemd dependenciesEPSS 0.2%CVE-2024-3933MEDIUMEclipse Open J9 With -Xgc:concurrentScavenge on IBM Z, could write/read outside of a bufferEPSS 0.2%CVE-2026-106464HIGHOut-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsingEPSS 0.2%CVE-2026-89316MEDIUMLoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertionEPSS 0.2%CVE-2026-89319MEDIUMJweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocationEPSS 0.2%CVE-2026-102719MEDIUMNetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability checkEPSS 0.2%CVE-2026-102760HIGHWhen NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. BEPSS 0.2%CVE-2026-102762HIGHThe NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of pacEPSS 0.2%CVE-2026-15076HIGHIn versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client doesEPSS 0.2%CVE-2026-15075HIGHIn Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates alEPSS 0.2%CVE-2026-110726MEDIUMIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from tEPSS 0.2%CVE-2024-10031MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the unEPSS 0.2%CVE-2026-96402MEDIUMUSBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle countEPSS 0.2%CVE-2026-113644MEDIUMiofogctl command injection via Controller provisioning responseEPSS 0.2%CVE-2025-11143LOWThe Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs EPSS 0.2%