CVEs published by Eclipse Foundation

CVEs published by Eclipse Foundation (CVE Numbering Authority). 27 tracked.

• CVE-2026-61387 HIGH 7.5 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item c
• CVE-2026-63252 HIGH 7.5 UPGRADE In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial
• CVE-2026-60007 HIGH 7.4 UPGRADE In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for inv
• CVE-2026-58080 HIGH 8.2 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleM
• CVE-2026-62927 HIGH 7.5 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-
• CVE-2026-63248 MEDIUM 6.5 UPGRADE In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorizat
• CVE-2026-18353 HIGH 8.8 PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against a
• CVE-2026-12609 HIGH 7.5 UPGRADE In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/
• CVE-2026-46581 HIGH 7.5 UPGRADE In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly saniti
• CVE-2026-12605 CRITICAL 9.6 UPGRADE In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admi
• CVE-2026-60009 HIGH 8.8 UPGRADE In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload
• CVE-2026-61891 HIGH 7.5 UPGRADE In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-downlo
• CVE-2026-14574 MEDIUM 6.5 UPGRADE In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia
• CVE-2026-14304 MEDIUM 5.5 UPGRADE UPGRADE In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20
• CVE-2026-15803 HIGH 8.7 In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing w
• CVE-2026-89320 HIGH 8.8 `HmacShaCryptor.Hash` never hashed its input
• CVE-2026-89315 MEDIUM 6.9 `JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A"
• CVE-2026-89314 MEDIUM 6.9 `jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validati
• CVE-2026-89312 MEDIUM 6.9 `AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length
• CVE-2026-89318 MEDIUM 6.9 `JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` withou
• CVE-2026-89319 MEDIUM 6.3 `JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field
• CVE-2026-89316 MEDIUM 6.3 `LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions
• CVE-2026-89313 MEDIUM 6.3 `JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JW
• CVE-2026-89317 MEDIUM 6.3 gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it
• CVE-2026-111074 HIGH 8.7 In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remo
• CVE-2026-110938 HIGH 8.7 In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to imp
• CVE-2026-111075 HIGH 8.7 In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on

← Back to latest CVEs