Vulnerabilidades em Eclipse Foundation

298 resultados
Análise Vexday

Com 104 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Eclipse Foundation apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em ambiente real. Ainda assim, 9 vulnerabilidades de severidade crítica e 16 surgidas nos últimos 90 dias indicam ritmo de descoberta que exige atenção contínua. O CVE-2024-10525 se destaca como a falha de maior risco ativo, com escore EPSS de 0,579 — valor que aponta probabilidade relevante de exploração a curto prazo e deve ser tratado com prioridade nos ciclos de correção. A predominância de CWE-125 (leitura fora dos limites do buffer) como tipo de falha mais frequente sinaliza que revisões de segurança de memória em componentes nativos merecem atenção estrutural no processo de desenvolvimento.

CVE-2026-92449MEDIUMBinary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arenaEPSS 0.2%CVE-2026-91057MEDIUMOut-of-bounds read when a multi-line text view string ends with a carriage returnEPSS 0.2%CVE-2026-92446MEDIUMGUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loaderEPSS 0.2%CVE-2026-85201MEDIUMIn Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf mEPSS 0.2%CVE-2026-93649HIGHIn the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (EPSS 0.2%CVE-2026-102759MEDIUMNetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a deEPSS 0.2%CVE-2026-102725HIGHOut-of-bounds Read from Unvalidated MSRP Attribute List LengthEPSS 0.2%CVE-2026-102724HIGHNULL pointer dereference when evicting the last MSRP attribute in a participant's listEPSS 0.2%CVE-2026-95107HIGHModule object allocation size overflow corrupts the manager object poolEPSS 0.2%CVE-2026-102726HIGHUnbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds ReadEPSS 0.2%CVE-2026-94202MEDIUMModule block-pool create validates two of the four parameter words it readsEPSS 0.2%CVE-2026-102723HIGHNULL Pointer Dereference on MSRP Attribute Table ExhaustionEPSS 0.2%CVE-2026-102720MEDIUMDHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options bufferEPSS 0.2%CVE-2026-92612LOWIn Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::asEPSS 0.2%CVE-2026-102714HIGHICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanent loopEPSS 0.2%CVE-2026-92454MEDIUMJPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decodeEPSS 0.2%CVE-2026-94192HIGHModule object deallocation can free a live ThreadX kernel objectEPSS 0.1%CVE-2026-95109HIGHCortex-A7 module data validation checks only the first address of a caller-supplied rangeEPSS 0.1%CVE-2026-115653HIGHCortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged modeEPSS 0.1%CVE-2026-95111MEDIUMModule queue front-send validates a word count as a byte countEPSS 0.1%