Eclipse Foundation vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-114278 The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/Critical 9.8 · Oct 28, 2026
• CVE-2026-115216 In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs iCritical 9.1 · Oct 27, 2026
• CVE-2026-89320 `HmacShaCryptor.Hash` never hashed its input.High 8.8 · Oct 23, 2026
• CVE-2026-110938 In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and High 8.7 · Oct 21, 2026
• CVE-2026-111075 In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and High 8.7 · Oct 21, 2026
• CVE-2026-111074 In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service.High 8.7 · Oct 21, 2026
• CVE-2026-95109 The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte.High 8.5 · Oct 20, 2026
• CVE-2026-95107 A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`.High 7 · Oct 20, 2026
• CVE-2026-94192 A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txmHigh 8.5 · Oct 20, 2026
• CVE-2026-94018 The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request.High 8.8 · Oct 20, 2026
• CVE-2026-93475 The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for thCritical 9.3 · Oct 20, 2026
• CVE-2026-92853 The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a bytHigh 8.7 · Oct 20, 2026
• CVE-2026-92843 A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsHigh 8.7 · Oct 20, 2026
• CVE-2026-91189 The GUIX binary resource loader never checks that a font page's glyph range is well formed.High 7.1 · Oct 20, 2026
• CVE-2026-91186 The PNG chunk reader has no notion of chunk ordering.High 8.4 · Oct 20, 2026
• CVE-2026-91041 Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay.High 7.8 · Oct 20, 2026
• CVE-2026-113620 In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT.Critical 9.8 · Oct 20, 2026
• CVE-2026-113619 In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped LiHigh 7.5 · Oct 20, 2026
• CVE-2026-93649 In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the posHigh 7.5 · Oct 15, 2026
• CVE-2026-110724 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element High 7.5 · Oct 15, 2026
• CVE-2026-110723 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element High 7.5 · Oct 15, 2026
• CVE-2026-77711 When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).High 8.2 · Oct 15, 2026
• CVE-2026-76184 In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpCHigh 8.2 · Oct 15, 2026
• CVE-2026-103224 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloHigh 8.2 · Oct 15, 2026
• CVE-2026-103223 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length High 8.2 · Oct 15, 2026