CVE Program partner

eclipse

Eclipse Foundation

API
CVEs, 365 days165348 all time, 4 rejected
Quality94%median 99%
CVSS by the CNA94%share of records
CWE89%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA5%lower is better
OrganisationEclipse Foundation
RoleCNA
TypeVendor, Open Source
Reports tomitre
ScopeAll projects hosted by the Eclipse Foundation as listed at <a href='https://www.eclipse.org/projects/' target='_blank'>https://www.eclipse.org/projects/</a> and services provided by the Eclipse Foundation to support open source projects as listed at <a href='https://www.eclipsestatus.io/' target='_blank'>https://www.eclipsestatus.io/</a>.
Advisorieshttps://www.eclipse.org/security/known.php

Latest CVEs · RSS

  • CVE-2026-93649 2026-10-15
    In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the pos
  • CVE-2026-110723 2026-10-15
    In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element
  • CVE-2026-110724 2026-10-15
    In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element
  • CVE-2026-110726 2026-10-15
    In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element
  • CVE-2026-18659 2026-10-15 · CVSS 6.9
    In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-
  • CVE-2026-18662 2026-10-15 · CVSS 6.9
    In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set
  • CVE-2026-19864 2026-10-15 · CVSS 5.6
    Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the a
  • CVE-2026-19863 2026-10-15 · CVSS 9.3
    An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. Thi
  • CVE-2026-18660 2026-10-15 · CVSS 8.8
    In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through th
  • CVE-2026-18661 2026-10-15 · CVSS 8.8
    In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@Serv
  • CVE-2026-77711 2026-10-15 · CVSS 8.2
    When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mis
  • CVE-2026-76184 2026-10-15 · CVSS 8.2
    In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpC
  • CVE-2026-76182 2026-10-15 · CVSS 6.9
    In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the re
  • CVE-2026-102477 2026-10-15 · CVSS 8.7
    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum si
  • CVE-2026-102464 2026-10-15 · CVSS 8.2
    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every in
  • CVE-2026-102461 2026-10-15 · CVSS 8.7
    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise compa
  • CVE-2026-103224 2026-10-15 · CVSS 8.2
    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet paylo
  • CVE-2026-103223 2026-10-15 · CVSS 8.2
    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length
  • CVE-2026-102466 2026-10-15 · CVSS 8.2
    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an a
  • CVE-2026-102463 2026-10-15 · CVSS 8.2
    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.bina
  • CVE-2026-102469 2026-10-15 · CVSS 9.2
    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol
  • CVE-2026-102462 2026-10-15 · CVSS 8.2
    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql
  • CVE-2026-102465 2026-10-15 · CVSS 8.2
    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a l
  • CVE-2026-102475 2026-10-15 · CVSS 8.7
    In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffer
  • CVE-2026-102467 2026-10-15 · CVSS 8.7
    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number o

All CVE Program partners