CVE-2026-102461 HIGH 8.7 Eclipse Vert.X — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueIte… 2026-10-15 CVE-2026-102462 HIGH 8.2 Eclipse Vert.X — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS messa… 2026-10-15 CVE-2026-102463 HIGH 8.2 Eclipse Vert.X — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary ar… 2026-10-15 CVE-2026-102464 HIGH 8.2 Eclipse Vert.X — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse V… 2026-10-15 CVE-2026-102465 HIGH 8.2 Eclipse Vert.X — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Re… 2026-10-15 CVE-2026-102466 HIGH 8.2 Eclipse Vert.X — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x My… 2026-10-15 CVE-2026-102467 HIGH 8.7 Eclipse Vert.X — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket… 2026-10-15 CVE-2026-102469 CRITICAL 9.2 Eclipse Vert.X — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB… 2026-10-15 CVE-2026-102475 HIGH 8.7 Eclipse Vert.X — In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body t… 2026-10-15 CVE-2026-102477 HIGH 8.7 Eclipse Vert.X — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoi… 2026-10-15 CVE-2026-103223 HIGH 8.2 Eclipse Vert.X — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQ… 2026-10-15 CVE-2026-103224 HIGH 8.2 Eclipse Vert.X — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL mes… 2026-10-15 CVE-2026-110723 HIGH 7.5 Eclipse Connected Services Platform — In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives th… 2026-10-15 CVE-2026-110724 HIGH 7.5 Eclipse Connected Services Platform — In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives th… 2026-10-15 CVE-2026-110726 MEDIUM 6.5 Eclipse Connected Services Platform — In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives th… 2026-10-15 CVE-2026-18659 MEDIUM 6.9 Eclipse Foundation — In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servle…● PoC 2026-10-15 CVE-2026-18660 HIGH 8.8 Eclipse Foundation — In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist i…● PoC 2026-10-15 CVE-2026-18661 HIGH 8.8 Eclipse Foundation — In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spe…● PoC 2026-10-15 CVE-2026-18662 MEDIUM 6.9 Eclipse Foundation — In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security …● PoC 2026-10-15 CVE-2026-19863 CRITICAL 9.3 Eclipse Foundation — An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the reque…● PoC 2026-10-15 CVE-2026-19864 MEDIUM 5.6 Eclipse Foundation — Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the … 2026-10-15 CVE-2026-76182 MEDIUM 6.9 Eclipse Jetty — In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URI…● PoC 2026-10-15 CVE-2026-76184 HIGH 8.2 Eclipse Jetty — In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an att…● PoC 2026-10-15 CVE-2026-77711 HIGH 8.2 Eclipse Jetty — When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 …● PoC 2026-10-15 CVE-2026-93649 HIGH 7.5 Adoptium Temurin — In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up … 2026-10-15 CVE-2026-102460 HIGH 8.6 Eclipse Vert.X — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypas… 2026-10-14 CVE-2026-102471 MEDIUM 6.9 Eclipse Vert.X — In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mai… 2026-10-14 CVE-2026-102476 CRITICAL 9.1 Eclipse Vert.X — In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on… 2026-10-14 CVE-2026-102479 HIGH 8.7 Eclipse Vert.X — In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses… 2026-10-14 CVE-2026-103414 HIGH 8.4 Guix — The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse … 2026-10-14 CVE-2026-103415 CRITICAL 9.3 Netx Duo — When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello… 2026-10-14 CVE-2026-106464 HIGH 8.7 Netx Duo — `_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without… 2026-10-14 CVE-2026-106465 HIGH 8.7 Netx Duo — The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks t… 2026-10-14 CVE-2026-92877 HIGH 8.3 Jaxb Ri (Core) — The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Ent… 2026-10-12 CVE-2026-103416 CRITICAL 9.3 Eclipse Threadx Netx Duo — Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.2026… 2026-10-07 CVE-2026-86671 HIGH 8.4 Eclipse Che — In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoint… 2026-10-05 CVE-2026-101322 HIGH 8.3 Eclipse Basyx Aas Web Ui — In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler a… 2026-10-01 CVE-2026-102717 HIGH 7.5 Netx Duo — MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash 2026-09-30 CVE-2026-102709 HIGH 8.4 Threadx — Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functi… 2026-09-29 CVE-2026-102710 CRITICAL 9.3 Eclipse Threadx/Threadx — Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing … 2026-09-29 CVE-2026-102711 MEDIUM 5.6 `Eclipse Threadx/Threadx` (Module Manager / Loadable Module Loader) — Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module ob… 2026-09-29 CVE-2026-102712 HIGH 8.8 Netx Duo — On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphe… 2026-09-29 CVE-2026-102713 HIGH 8.8 Netx Duo — The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four byt… 2026-09-29 CVE-2026-102714 HIGH 7.1 Netx Duo — `_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validat… 2026-09-29 CVE-2026-102715 HIGH 7.1 Eclipse Threadx/Netxduo — Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit pac… 2026-09-29 CVE-2026-102716 HIGH 8.7 Eclipse Threadx/Netxduo — An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carr… 2026-09-29 CVE-2026-102718 HIGH 8.7 Netx Duo — hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data len… 2026-09-29 CVE-2026-102719 MEDIUM 6.3 Netxduo — Predictable DTLS HelloVerifyRequest Cookie in NetX Secure 2026-09-29 CVE-2026-102720 MEDIUM 5.3 Eclipse Threadx/Netxduo — A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte… 2026-09-29 CVE-2026-102721 MEDIUM 6.9 Netx Duo — A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received… 2026-09-29 CVE-2026-102722 MEDIUM 6.9 Netx Duo — In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validatio… 2026-09-29 CVE-2026-102723 MEDIUM 6 Netx Duo — NULL Pointer Dereference on MSRP Attribute Table Exhaustion 2026-09-29 CVE-2026-102724 MEDIUM 6 Netx Duo — NULL Pointer Dereference When Evicting the Sole MSRP Attribute 2026-09-29 CVE-2026-102725 MEDIUM 6 Netx Duo — Out-of-bounds Read from Unvalidated MSRP Attribute List Length 2026-09-29 CVE-2026-102726 MEDIUM 6 Netx Duo — Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read 2026-09-29 CVE-2026-102727 MEDIUM 6 Netx Duo — FTP Passive Data Connection Not Bound to the Authenticated Control Peer 2026-09-29 CVE-2026-102728 HIGH 7.5 Netx Duo — Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before va… 2026-09-29 CVE-2026-102729 MEDIUM 5.9 Guix — `gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the… 2026-09-29 CVE-2026-102730 HIGH 8.6 Eclipse Threadx/Levelx(Nand Driver) — Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds … 2026-09-29 CVE-2026-102757 HIGH 8.5 Threadx — An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its… 2026-09-29 CVE-2026-102758 HIGH 7.5 Netx Duo — The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-en… 2026-09-29 CVE-2026-102759 MEDIUM 6.3 Netx Duo — NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In… 2026-09-29 CVE-2026-102760 HIGH 8.3 Netx Duo — When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped afte… 2026-09-29 CVE-2026-102761 CRITICAL 9.3 Netx Duo — NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through… 2026-09-29 CVE-2026-102762 HIGH 8.2 Netx Duo — The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs o… 2026-09-29 CVE-2026-90882 HIGH 8.7 Open Vsx.Org — The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together wit… 2026-09-22 CVE-2026-92612 LOW 1 Eclipse Iceoryx™ — In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes throu…● PoC 2026-09-21 CVE-2025-12999 CRITICAL 9.1 Eclipse Open Vsx — UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from t…● PoC 2026-09-21 CVE-2026-92611 MEDIUM 4.8 Eclipse Ankaios — In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorize… 2026-09-17 CVE-2026-78299 CRITICAL 9.1 Eclipse Embedded Cdt (C/C++ Development Tools) — In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the ar… 2026-09-14 CVE-2026-86836 HIGH 8.4 Eclipse Ankaios — In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named … 2026-09-14 CVE-2026-88819 MEDIUM 6.3 Eclipse Data Plane Core — In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer… 2026-09-14 CVE-2026-89321 MEDIUM 4.3 Eclipse Openvsx — Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but noth… 2026-09-14 CVE-2026-12611 HIGH 8.7 Eclipse Jetty — A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, … 2026-09-08 CVE-2026-19203 HIGH 8.3 Eclipse Jetty — A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an inter… 2026-09-08 CVE-2026-84197 CRITICAL 9.2 Eclipse Ditto — In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-… 2026-09-08 CVE-2026-86464 CRITICAL 9.9 Eclipse Aerios — In the current development version of Eclipse aeriOS, for which no official release has yet been published, th… 2026-09-08 CVE-2026-86590 MEDIUM 6.3 Eclipse Che — In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endp…● PoC 2026-09-08 CVE-2026-19204 HIGH 8.7 Eclipse Jetty — A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing J… 2026-09-07 CVE-2026-84173 HIGH 8.3 Eclipse Ankaios — In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly eva…● PoC 2026-09-07 CVE-2026-85201 MEDIUM 6.8 Eclipse Ankaios — In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in… 2026-09-07