EC
Vendor
Eclipse
317
CVEs
1
On KEV
15
New 30D
Products
VE9.8
Vert.x
Eclipse
27 CVEs0 on KEV15 new
JE9.8
Jetty
Eclipse
52 CVEs1 on KEV0 new
MO9.8
Mosquitto
Eclipse
26 CVEs0 on KEV0 new
OP9.8
Openj9
Eclipse
23 CVEs0 on KEV0 new
TN9.8
Threadx Netx Duo
Eclipse
21 CVEs0 on KEV0 new
TH9.8
Theia
Eclipse
15 CVEs0 on KEV0 new
TU9.8
Threadx Usbx
Eclipse
15 CVEs0 on KEV0 new
GL9.8
Glassfish
Eclipse
13 CVEs0 on KEV0 new
MI8.2
Milo
Eclipse
7 CVEs0 on KEV0 new
OM9.8
Omr
Eclipse
7 CVEs0 on KEV0 new
KU9.8
Kura
Eclipse
6 CVEs0 on KEV0 new
TH7.8
Threadx
Eclipse
6 CVEs0 on KEV0 new
CA8.2
Californium
Eclipse
4 CVEs0 on KEV0 new
CH8.8
Che
Eclipse
4 CVEs0 on KEV0 new
CD10.0
Cyclone Data Distribution Service
Eclipse
4 CVEs0 on KEV0 new
MO7.5
Mojarra
Eclipse
4 CVEs0 on KEV0 new
OV8.7
Open Vsx
Eclipse
4 CVEs0 on KEV0 new
BI9.8
Business Intelligence And Reporting Tools
Eclipse
3 CVEs0 on KEV0 new
EI5.0
Eclipse Ide
Eclipse
3 CVEs0 on KEV0 new
HA8.1
Hawkbit
Eclipse
3 CVEs0 on KEV0 new
JG9.8
Jgit
Eclipse
3 CVEs0 on KEV0 new
MA9.0
Memory Analyzer
Eclipse
3 CVEs0 on KEV0 new
VE8.8
Vert.x-web
Eclipse
3 CVEs0 on KEV0 new
CY9.8
Cyclonedds
Eclipse
2 CVEs0 on KEV0 new
ED8.1
Eclipse Dataspace Components
Eclipse
2 CVEs0 on KEV0 new
EO9.8
Equinox OSGi
Eclipse
2 CVEs0 on KEV0 new
HO8.8
Hono
Eclipse
2 CVEs0 on KEV0 new
JE7.4
Jersey
Eclipse
2 CVEs0 on KEV0 new
KE9.9
Keti
Eclipse
2 CVEs0 on KEV0 new
LE6.5
Lemminx
Eclipse
2 CVEs0 on KEV0 new
OP9.8
Openmq
Eclipse
2 CVEs0 on KEV0 new
PA7.5
Parsson
Eclipse
2 CVEs0 on KEV0 new
RD10.0
Rdf4j
Eclipse
2 CVEs0 on KEV0 new
TI7.5
Tinydtls
Eclipse
2 CVEs0 on KEV0 new
WA7.5
Wakaama
Eclipse
2 CVEs0 on KEV0 new
WW8.8
Wild Web Developer
Eclipse
2 CVEs0 on KEV0 new
4F9.8
4diac Forte
Eclipse
1 CVEs0 on KEV0 new
AT5.5
Accessibility Tools Framework
Eclipse
1 CVEs0 on KEV0 new
AM7.5
Angus Mail
Eclipse
1 CVEs0 on KEV0 new
BI–
Birt
Eclipse
1 CVEs0 on KEV0 new
BU8.1
Buildship
Eclipse
1 CVEs0 on KEV0 new
DE5.3
Deeplearning4j
Eclipse
1 CVEs0 on KEV0 new
DI5.4
Ditto
Eclipse
1 CVEs0 on KEV0 new
EC5.3
Edc Connector
Eclipse
1 CVEs0 on KEV0 new
EG9.8
Egit
Eclipse
1 CVEs0 on KEV0 new
EQ8.1
Equinox
Eclipse
1 CVEs0 on KEV0 new
EP8.0
Equinox P2
Eclipse
1 CVEs0 on KEV0 new
GR5.3
Grizzly
Eclipse
1 CVEs0 on KEV0 new
HU9.8
Hudson
Eclipse
1 CVEs0 on KEV0 new
ID7.5
Ide
Eclipse
1 CVEs0 on KEV0 new
JE5.3
Jakarta Expression Language
Eclipse
1 CVEs0 on KEV0 new
JM7.5
Jakarta Mail
Eclipse
1 CVEs0 on KEV0 new
KU6.5
Kuksa
Eclipse
1 CVEs0 on KEV0 new
LE9.8
Leshan
Eclipse
1 CVEs0 on KEV0 new
LY5.3
Lyo
Eclipse
1 CVEs0 on KEV0 new
OR5.0
Org.eclipse.core.runtime
Eclipse
1 CVEs0 on KEV0 new
PJ7.5
Paho Java Client
Eclipse
1 CVEs0 on KEV0 new
PM5.3
Paho Mqtt
Eclipse
1 CVEs0 on KEV0 new
PM9.8
Paho Mqtt C/c++ Client
Eclipse
1 CVEs0 on KEV0 new
PD5.0
Pde
Eclipse
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102477 | VE Vert.x Eclipse | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes,… |
| CVE-2026-102464 | VE Vert.x Eclipse | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH… |
| CVE-2026-102461 | VE Vert.x Eclipse | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no… |
| CVE-2026-103224 | VE Vert.x Eclipse | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a… |
| CVE-2026-103223 | VE Vert.x Eclipse | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the… |
| CVE-2026-102466 | VE Vert.x Eclipse | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column… |
| CVE-2026-102463 | VE Vert.x Eclipse | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray)… |
| CVE-2026-102469 | VE Vert.x Eclipse | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that… |
| CVE-2026-102462 | VE Vert.x Eclipse | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates… |
| CVE-2026-102465 | VE Vert.x Eclipse | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by… |
| CVE-2026-102475 | VE Vert.x Eclipse | 5.9 | Oct 15 | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to… |
| CVE-2026-102467 | VE Vert.x Eclipse | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation… |
| CVE-2026-102471 | VE Vert.x Eclipse | 5.9 | Oct 14 | CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages |
| CVE-2026-102479 | VE Vert.x Eclipse | 5.9 | Oct 14 | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization… |
| CVE-2026-102460 | VE Vert.x Eclipse | 5.9 | Oct 14 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when… |
| CVE-2026-12605 | GL Glassfish Eclipse | 9.6 | Aug 6 | In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is… |
| CVE-2026-46581 | MO Mojarra Eclipse | 7.5 | Aug 5 | In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to… |
| CVE-2026-61891 | TH Theia Eclipse | 7.5 | Aug 5 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert… |
| CVE-2026-60009 | TH Theia Eclipse | 8.8 | Aug 5 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment |
| CVE-2026-12609 | TH Theia Eclipse | 7.5 | Aug 5 | In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the… |
| CVE-2026-14574 | TH Theia Eclipse | 6.5 | Aug 5 | In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting… |
| CVE-2026-14304 | AT Accessibility Tools Framework Eclipse | 5.5 | Aug 5 | In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it… |
| CVE-2026-63248 | MI Milo Eclipse | 6.5 | Aug 4 | In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization |
| CVE-2026-58080 | MI Milo Eclipse | 8.2 | Aug 4 | In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper` |
| CVE-2026-63252 | MI Milo Eclipse | 7.5 | Aug 4 | In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote… |
| CVE-2026-62927 | MI Milo Eclipse | 7.5 | Aug 4 | In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous… |
| CVE-2026-60007 | MI Milo Eclipse | 7.4 | Aug 4 | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures,… |
| CVE-2026-61387 | MI Milo Eclipse | 7.5 | Aug 4 | In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation… |
| CVE-2026-10050 | JE Jetty Eclipse | 9.1 | Aug 4 | Digest authentication lossy encoding |
| CVE-2026-16441 | OP Openj9 Eclipse | 9.6 | Jul 21 | Eclipse OpenJ9 : Method resolution default method precedence failure |
| CVE-2026-16243 | OM Omr Eclipse | 7.5 | Jul 21 | Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero |
| CVE-2026-16439 | OP Openj9 Eclipse | 9.1 | Jul 21 | Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow |
| CVE-2026-16454 | HA Hawkbit Eclipse | 4.3 | Jul 21 | Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration |
| CVE-2024-7708 | JE Jetty Eclipse | 7.5 | Jul 14 | For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak |
| CVE-2026-8384 | JE Jetty Eclipse | 5.3 | Jul 14 | In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the… |
| CVE-2026-6790 | JE Jetty Eclipse | 5.3 | Jul 14 | In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present) |
| CVE-2026-10051 | JE Jetty Eclipse | 7.5 | Jul 14 | In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection |
| CVE-2026-12606 | GR Grizzly Eclipse | 5.3 | Jul 14 | Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling |
| CVE-2026-15075 | VE Vert.x Eclipse | 7.5 | Jul 14 | In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across… |
| CVE-2026-15076 | VE Vert.x Eclipse | 7.5 | Jul 14 | In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute… |
| CVE-2026-9561 | KU Kura Eclipse | 8.2 | Jul 14 | Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries |
| CVE-2026-13699 | KU Kuksa Eclipse | 6.5 | Jul 14 | Databroker 0.6.1 PublishValue missing data_point panic |
| CVE-2026-13323 | OV Open Vsx Eclipse | 8.7 | Jul 1 | In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or… |
| CVE-2026-4983 | OV Open Vsx Eclipse | 5.4 | Jun 23 | Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security headers such as… |
| CVE-2026-11576 | TN Threadx Netx Duo Eclipse | 7.5 | Jun 19 | The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path… |
| CVE-2026-44691 | TH Theia Eclipse | 8.8 | Jun 18 | In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g |
| CVE-2026-22551 | TH Theia Eclipse | 6.5 | Jun 18 | In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction |
| CVE-2026-46580 | TH Theia Eclipse | 8.8 | Jun 18 | In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI… |
| CVE-2026-44688 | TH Theia Eclipse | 8.8 | Jun 18 | In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system… |
| CVE-2026-9158 | 4F 4diac Forte Eclipse | 9.8 | Jun 18 | In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer |
| CVE-2026-2586 | GL Glassfish Eclipse | 9.1 | May 19 | An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console |
| CVE-2026-2587 | GL Glassfish Eclipse | 9.6 | May 19 | A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler |
| CVE-2026-6860 | VE Vert.x Eclipse | 5.3 | May 6 | A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g |
| CVE-2026-6918 | OP Openj9 Eclipse | 7.5 | May 5 | In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message |
| CVE-2023-54344 | EO Equinox OSGi Eclipse | 9.8 | May 5 | Eclipse Equinox OSGi 3.7.2 Remote Code Execution via Console |
| CVE-2023-54342 | EO Equinox OSGi Eclipse | 9.8 | May 5 | Eclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution |
| CVE-2026-2332 | JE Jetty Eclipse | 9.1 | Apr 14 | HTTP Request Smuggling via Chunked Extension Quoted-String Parsing |
| CVE-2026-5795 | JE Jetty Eclipse | 7.4 | Apr 8 | In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable |
| CVE-2026-24457 | OP Openmq Eclipse | 9.8 | Mar 5 | An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server |
| CVE-2026-1605 | JE Jetty Eclipse | 7.5 | Mar 5 | In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed… |