EO
Product
Eclipse Open VSX
3
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 1Medium 1Low 0
Watch
Add Eclipse Open VSX to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-12999 | 9.1 | Sep 21 | UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request… Affected: 0.6.0 through 1.1.2 |
| CVE-2026-13323 | 8.7 | Jul 1 | In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or… Affected: 0.1.0 before 1.0.2 |
| CVE-2026-4983 | 5.4 | Jun 23 | Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security headers such as… Affected: 0.1.0 before 0.34.1 |
Showing 3