EC
Product
Eclipse CSI - PIA
5
CVEs
0
On KEV
8.8
Max CVSS
2
New 30D
Severity mix
Critical 0High 2Medium 3Low 0
Watch
Add Eclipse CSI - PIA to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-18353 | 8.8 | Jul 30 | Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass Affected: 0.4.0 before 0.6.0 |
| CVE-2026-14336 | 8.2 | Jul 2 | PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of… Affected: through 0.3.0 |
| CVE-2026-108062 | 6.9 | Oct 20 | Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop Affected: through 0.8.0 |
| CVE-2026-12616 | 6.9 | Jun 29 | The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into three log statements… Affected: through 0.2.1 |
| CVE-2026-107597 | 5.1 | Oct 20 | jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme Affected: through 0.8.0 |
Showing 5