Vulnerabilidades em Eclipse Foundation

298 resultados
Análise Vexday

Com 104 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Eclipse Foundation apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em ambiente real. Ainda assim, 9 vulnerabilidades de severidade crítica e 16 surgidas nos últimos 90 dias indicam ritmo de descoberta que exige atenção contínua. O CVE-2024-10525 se destaca como a falha de maior risco ativo, com escore EPSS de 0,579 — valor que aponta probabilidade relevante de exploração a curto prazo e deve ser tratado com prioridade nos ciclos de correção. A predominância de CWE-125 (leitura fora dos limites do buffer) como tipo de falha mais frequente sinaliza que revisões de segurança de memória em componentes nativos merecem atenção estrutural no processo de desenvolvimento.

CVE-2026-89314MEDIUMQuadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 sEPSS 0.4%CVE-2026-58080HIGHIn Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely oEPSS 0.4%CVE-2024-9202MEDIUMEDC DataSetResolver policy filtering missingEPSS 0.4%CVE-2026-106465MEDIUMMissing HelloVerifyRequest cookie validation in the NetX Secure DTLS serverEPSS 0.4%CVE-2026-111075HIGHJITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserializationEPSS 0.4%CVE-2025-55090MEDIUMPotential out of bound read issue in _nx_ipv4_packet_receive() in NetX DuoEPSS 0.4%CVE-2025-55091MEDIUMPotential out of bound read in _nx_ip_packet_receive()EPSS 0.4%CVE-2025-55081MEDIUMPotential out of bound read in _nx_secure_tls_process_clienthello()EPSS 0.4%CVE-2026-114408HIGHNULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is fullEPSS 0.4%CVE-2026-107597MEDIUMjwks_uri from the OIDC discovery document is fetched without checking its origin or schemeEPSS 0.4%CVE-2026-16454MEDIUMPrivilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware ExfiltrationEPSS 0.4%CVE-2026-89313MEDIUMJwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nilEPSS 0.3%CVE-2026-9563HIGHIn Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number oEPSS 0.3%CVE-2026-76182MEDIUMIn Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, wheEPSS 0.3%CVE-2025-55099LOWPotential out-of-bounds read in _ux_host_class_audio_alternate_setting_locate()EPSS 0.3%CVE-2026-84197CRITICALIn Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and oEPSS 0.3%CVE-2026-82180CRITICALIn Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFiEPSS 0.3%CVE-2026-118489HIGHCachingWebClient shares user-specific HTTP responses across users via the shared cache tierEPSS 0.3%CVE-2024-9408HIGHIn Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.EPSS 0.3%CVE-2024-2214HIGHMissing array size check in _Mtxinit() in the Xtensa portEPSS 0.3%