Vulnerabilidades em Eclipse Foundation

298 resultados
Análise Vexday

Com 104 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Eclipse Foundation apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em ambiente real. Ainda assim, 9 vulnerabilidades de severidade crítica e 16 surgidas nos últimos 90 dias indicam ritmo de descoberta que exige atenção contínua. O CVE-2024-10525 se destaca como a falha de maior risco ativo, com escore EPSS de 0,579 — valor que aponta probabilidade relevante de exploração a curto prazo e deve ser tratado com prioridade nos ciclos de correção. A predominância de CWE-125 (leitura fora dos limites do buffer) como tipo de falha mais frequente sinaliza que revisões de segurança de memória em componentes nativos merecem atenção estrutural no processo de desenvolvimento.

CVE-2026-7412HIGHIn Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination UREPSS 0.5%CVE-2025-55089CRITICALEclipse ThreadX FileX RAM disk driver buffer overflowEPSS 0.5%CVE-2026-18918CRITICALOAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed defaultEPSS 0.5%CVE-2026-44688HIGHIn Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context withEPSS 0.5%CVE-2026-46580HIGHIn Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded andEPSS 0.5%CVE-2025-11965MEDIUMIn Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails toEPSS 0.5%CVE-2026-19863CRITICALAn unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configureEPSS 0.5%CVE-2024-5165MEDIUMEclipse Ditto User Interface vulnerable to XSS due to Improper Neutralization of InputEPSS 0.5%CVE-2026-1188MEDIUMIn the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor featurEPSS 0.5%CVE-2024-9342MEDIUMIn Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of faEPSS 0.5%CVE-2026-79653MEDIUMIn Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enaEPSS 0.5%CVE-2026-15803HIGHIn Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-baseEPSS 0.5%CVE-2026-80515HIGHIn Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whetEPSS 0.5%CVE-2026-108062MEDIUMPre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loopEPSS 0.5%CVE-2026-15704CRITICALCWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go ComponentsEPSS 0.5%CVE-2026-11576HIGHThe security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanEPSS 0.5%CVE-2026-89293HIGHMissing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tamperingEPSS 0.5%CVE-2026-102469CRITICALIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) coEPSS 0.5%CVE-2026-22886CRITICALOpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a defaulEPSS 0.5%CVE-2025-55087MEDIUMIn NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an out-of-bound read by aEPSS 0.5%