eclipse-foundation

Top products

The 15 most recently published vulnerabilities affecting eclipse-foundation.

• CVE-2026-12605In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Adm...9.6Aug 6, 2026
• CVE-2026-46581In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet ...7.5Aug 5, 2026
• CVE-2026-61891In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied...7.5Aug 5, 2026
• CVE-2026-60009In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolu...8.8Aug 5, 2026
• CVE-2026-12609In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path ...7.5Aug 5, 2026
• CVE-2026-14574In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting prototype-related keys (`...6.5Aug 5, 2026
• CVE-2026-63248In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a cer...6.5Aug 4, 2026
• CVE-2026-58080In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuratio...8.2Aug 4, 2026
• CVE-2026-63252In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to ...7.5Aug 4, 2026
• CVE-2026-62927In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-...7.5Aug 4, 2026
• CVE-2026-60007In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path att...7.4Aug 4, 2026
• CVE-2026-61387In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. D...7.5Aug 4, 2026
• CVE-2026-10050Digest authentication lossy encoding9.1Aug 4, 2026
• CVE-2026-15704CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components9.8Jul 24, 2026
• CVE-2026-16454Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration4.3Jul 21, 2026