Vulnerabilidades em Eclipse Foundation

298 resultados
Análise Vexday

Com 104 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Eclipse Foundation apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em ambiente real. Ainda assim, 9 vulnerabilidades de severidade crítica e 16 surgidas nos últimos 90 dias indicam ritmo de descoberta que exige atenção contínua. O CVE-2024-10525 se destaca como a falha de maior risco ativo, com escore EPSS de 0,579 — valor que aponta probabilidade relevante de exploração a curto prazo e deve ser tratado com prioridade nos ciclos de correção. A predominância de CWE-125 (leitura fora dos limites do buffer) como tipo de falha mais frequente sinaliza que revisões de segurança de memória em componentes nativos merecem atenção estrutural no processo de desenvolvimento.

CVE-2026-19204HIGHA client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memoryEPSS 0.5%CVE-2026-89292CRITICALUnauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured InfrastructuresEPSS 0.5%CVE-2026-60009HIGHIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled EPSS 0.4%CVE-2026-90882HIGHReflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user dataEPSS 0.4%CVE-2026-77711HIGHWhen Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication RequiredEPSS 0.4%CVE-2024-7708HIGHFor requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case forEPSS 0.4%CVE-2026-89321MEDIUMPublishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entryEPSS 0.4%CVE-2026-118488MEDIUMHeap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis clientEPSS 0.4%CVE-2026-12605CRITICALIn Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-coEPSS 0.4%CVE-2026-16439MEDIUMEclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflowEPSS 0.4%CVE-2026-10051MEDIUMIn Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the EPSS 0.4%CVE-2026-12611HIGHA client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threadsEPSS 0.4%CVE-2023-2597HIGHIn Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size oEPSS 0.4%CVE-2026-18661HIGHIn Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern ruEPSS 0.4%CVE-2026-111074HIGHJITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()EPSS 0.4%CVE-2026-62927HIGHIn Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculatiEPSS 0.4%CVE-2026-110938HIGHJITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsingEPSS 0.4%CVE-2024-10917LOWEclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLengthEPSS 0.4%CVE-2025-55086MEDIUMIn NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked indEPSS 0.4%CVE-2026-115215HIGHNetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session poolEPSS 0.4%