Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
471 results · page 2 of 10
Oct 15, 2026In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission setCVE-2026-18662 · Other software · reported by emo@eclipse.orgMedium 6.9
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through thCVE-2026-18660 · Other software · reported by emo@eclipse.orgHigh 8.8
In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-CVE-2026-18659 · Other software · reported by emo@eclipse.orgMedium 6.9
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).CVE-2026-77711 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.
- Product
- Eclipse Jetty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpCCVE-2026-76184 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`. This also mean that the attacker must have an evil application deployed on the same domain as the target.
- Product
- Eclipse Jetty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the reCVE-2026-76182 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.
- Product
- Eclipse Jetty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServCVE-2026-18661 · Other software · reported by emo@eclipse.orgHigh 8.8
In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloCVE-2026-103224 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-mysql-client.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length CVE-2026-103223 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-pg-client.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum siCVE-2026-102477 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks. The impacted component is io.vertx:vertx-gprc-server.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocolCVE-2026-102469 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist. This code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). However, DB2 does not support this type of UDT. The FDOCA 0x50 type is never sent by a legitimate DB2 server. Nevertheless, a malicious or man-in-the-middle DRDA server could craft a response with a 0x50-tagged column, causing the client to deserialize arbitrary attacker-controlled bytes on the Vert.x event loop before any application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this enables remote code execution. Without a gadget chain, denial of service is possible via crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible. The impacted component is io.vertx:vertx-db2-client.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an aCVE-2026-102466 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a server-declared column count with no upper-bound validation. A malicious or compromised MySQL server, or an attacker with man-in-the-middle positioning, can send a crafted result set packet with an extremely large column count, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Netty event loop thread, causing a complete denial of service for all connections and verticles in the Vert.x application. The impacted component is io.vertx:vertx-mysql-client.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inCVE-2026-102464 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet to complete the QoS 2 handshake. This map has no size limit; the maxInflightQueue option is enforced only on the outbound publish path and does not constrain inbound message retention. A malicious or compromised MQTT broker can exploit this by sending QoS 2 PUBLISH messages with distinct packet identifiers and withholding the PUBREL responses. Each incomplete handshake causes the client to retain the full publish message (topic, payload, and metadata) indefinitely, leading to unbounded memory growth in the Vert.x process. This can degrade the MQTT-consuming application or cause out-of-memory termination. The impacted component is io.vertx:vertx-mqtt.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaCVE-2026-102463 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL server, or an on-path attacker intercepting an unencrypted connection, can send a crafted DataRow message with an excessively large array dimension value, causing the client to attempt a multi-gigabyte heap allocation and crash with an OutOfMemoryError. The impacted component is io.vertx:vertx-pg-client.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssqlCVE-2026-102462 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-mssql-client.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise compaCVE-2026-102461 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time, leading to denial of service. The impacted component is io.vertx:vertx-json-schema. The following Vert.x modules depend on vertx-json-schema and are also affected: io.vertx:vertx-web-openapi-router io.vertx:vertx-web-validation io.vertx:vertx-openapi
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max bufferCVE-2026-102475 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer. The impacted component is io.vertx:vertx-http-proxy.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number oCVE-2026-102467 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is io.vertx:vertx-core.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a lCVE-2026-102465 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Vert.x event loop thread, denying service to all connections and verticles sharing that loop. The impacted component is io.vertx:vertx-mysql-client.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, tCVE-2026-102479 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length. This can be exploited for request smuggling purpose. The impacted component is io.vertx:vertx-core.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) charCVE-2026-102471 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value passed to MailMessage.addHeader(), MailMessage.setHeaders(), MailAttachment.addHeader(), or MailAttachment.setHeaders() is written verbatim to the wire, allowing an attacker to inject arbitrary headers (e.g. Bcc, Reply-To, Content-Type) or prepend body content to the outgoing message. The same weakness affects MIME part metadata set via MailAttachment.setContentType(), setDisposition(), setDescription(), and setContentId(), which are written directly into MIME part headers without validation. A secondary weakness in Utils.mustEncode(char) additionally allows a bare LF in a From display-name to bypass Q-encoding and reach the wire unchanged. An unauthenticated attacker who can control any header name, header value, or attachment metadata field passed to the mail client (for example via a web form or API that feeds into MailMessage) can exploit this to redirect email copies
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChaCVE-2026-102460 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.6
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes. The root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped. This allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns.CVE-2026-106465 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. The ClientHello parser copies the client's cookie bytes over the value the server issued, and the server then decides whether the client has been verified from the cookie's length alone. A peer that puts any single cookie byte in its first ClientHello skips the verification exchange entirely, so the server has no return-routability check and completes handshakes for forged source addresses.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero.CVE-2026-106464 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of `0xFFFFFFFF` and a signature pointer one byte past the end of the buffer. Certificates are parsed from the peer during the TLS handshake, so the input is remote and unauthenticated.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgCVE-2026-103415 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.3
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate. Only the client path is affected.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetCVE-2026-103414 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.4
The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file. The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this. Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.
- Product
- GUIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key ofCVE-2026-102476 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.1
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation. The impacted component is io.vertx:vertx-core.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 12, 2026The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution.CVE-2026-92877 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.3
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.
- Product
- jaxb-ri (core)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 8, 2026In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI anCVE-2026-107503 · Other software · Eclipse Ditto · reported by emo@eclipse.orgHigh 7.1
In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI and the OpenID Connect (OIDC) provider settings, from an arbitrary cross-origin URL supplied in the environmentsURL query parameter. It adopts this configuration without user confirmation and persists it in the browser's localStorage. A crafted link can therefore set an attacker-controlled OIDC authority with autoSso enabled. The UI then automatically starts a login at the genuine identity provider but exchanges the returned authorization code together with its PKCE code_verifier at an attacker-controlled token endpoint. This lets the attacker redeem the code for the victim's access and refresh tokens. Alternatively, an attacker-controlled api_uri causes the UI to send the victim's bearer token or Basic credentials to the attacker. Because the configuration is persisted, later visits to the UI without the crafted link repeat the token theft. In versions 3.9.0 to 3.9.7, the Swagger UI OIDC integration of the Helm chart and the Docker Compose deployment is affected in the same way, but requires the user to start the login. The i
- Product
- Ditto Explorer UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeclipse.deveclipse.dev
Oct 7, 2026Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cachCVE-2026-103416 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.3
Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.
- Product
- Eclipse ThreadX - NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 5, 2026In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fCVE-2026-86671 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.4
In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host allow-list and returns the response body to the caller. Any authenticated Che user can read arbitrary local files via the file:// scheme (including the pod's Kubernetes service-account token at `file:///var/run/secrets/kubernetes.io/serviceaccount/token`), reach internal HTTP services and cloud instance metadata endpoints (169.254.169.254), and have their stored SCM personal access token attached as an `Authorization` header to a host of their choosing. The same credential-forwarding behavior also fires when a victim opens a workspace from a malicious devfile whose `parent.uri` points to an attacker-controlled server, enabling exfiltration of the victim's SCM PAT without direct API access. No fix is available.
- Product
- Eclipse Che
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.eclipse.orggitlab.eclipse.org
Oct 1, 2026In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `AuthorizatiCVE-2026-101322 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.3
In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a user to open a crafted Web UI link whose `aas` or `path` query parameter points to an attacker-controlled endpoint. The user's browser would then send the configured Basic Authentication credentials, Bearer token, or an available OAuth2 access token to that endpoint. The attacker could reuse the disclosed credential to access protected AAS services with the victim's privileges. The issue is fixed in v2-260924.
- Product
- Eclipse BaSyx AAS Web UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026MQTT WebSocket setter ABI mismatch may disclose memory or cause a crashCVE-2026-102717 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.5
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message.CVE-2026-102762 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.2
The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbound network traffic on the device until it is rebooted.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound beCVE-2026-102761 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.3
NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drives the XOR loop through the first packet's unused payload area and on through the second packet's `NX_PACKET` control block. The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP.CVE-2026-102760 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.3
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in use by another thread, and when a reused packet's pointers no longer describe the old data, the length of the wipe underflows and it runs past the end of the packet pool.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026NetX Secure TLS accepts an empty application-data record without verifying its message authentication code.CVE-2026-102759 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a decrypted application record whose length equals the negotiated MAC size is treated as valid and returns success after advancing the receive sequence number. The received MAC is never generated or compared. Empty TLS application-data records are legal, and are commonly emitted by TLS 1.0 implementations as a BEAST mitigation.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data.CVE-2026-102758 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.5
The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake. The function reads the one-byte ASN.1 tag from the caller's buffer *before* checking that the buffer holds at least one byte. When a caller passes a remaining length of zero, the guard correctly returns `NX_SECURE_X509_ASN1_LENGTH_TOO_LONG`, but the read has already happened one byte past the end of the buffer. code: nx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c ``` UINT _nx_secure_x509_asn1_tlv_block_parse(const UCHAR *buffer, ULONG *buffer_length, USHORT *tlv_type, USHORT *tlv_tag_class, ULONG *tlv_length, const UCHAR **tlv_data, ULONG *header_length) { UINT current_index; USHORT current_tag; ULONG length; ULONG length_bytes; current_index = 0; current_tag = buffer[current_index]; /* <-- read before the bounds check */ if (*buffer_length < 1) { ret
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that toCVE-2026-102757 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.5
An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module Manager decided whether a privileged service could dereference an object address a module named by asking only whether that address fell outside the module. The manager's object pool is outside every module, so the test was satisfied by an address shifted into the interior of one of the module's own privileged allocations, which denotes no object at all. The bytes such an address presents as a control block are bytes the module put there through ordinary create and set services, so the control block ID at the front of them could be made to read as any type the module chose, and the `_txe_` layer's ID test then agreed. The reported chain uses that to reach a privileged `memset` across an attacker-chosen range.
- Product
- ThreadX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-CVE-2026-102730 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.6
Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`. (The affected metadata-parser header states "Some portions generated by Copilot (Sonnet 4.6)" — an AI-generated parser with an unchecked on-flash count.)
- Product
- eclipse-threadx/levelx(NAND driver)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id.CVE-2026-102729 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.9
`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.
- Product
- GUIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contaiCVE-2026-102728 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.5
Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026FTP Passive Data Connection Not Bound to the Authenticated Control PeerCVE-2026-102727 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
FTP Passive Data Connection Not Bound to the Authenticated Control Peer
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds ReadCVE-2026-102726 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Out-of-bounds Read from Unvalidated MSRP Attribute List LengthCVE-2026-102725 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
Out-of-bounds Read from Unvalidated MSRP Attribute List Length
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026NULL Pointer Dereference When Evicting the Sole MSRP AttributeCVE-2026-102724 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
NULL Pointer Dereference When Evicting the Sole MSRP Attribute
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026NULL Pointer Dereference on MSRP Attribute Table ExhaustionCVE-2026-102723 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6
NULL Pointer Dereference on MSRP Attribute Table Exhaustion
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply.CVE-2026-102722 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram.CVE-2026-102721 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long (nxd_tftp_client.c:1229, 1521, 1984). When the opcode is NX_TFTP_CODE_ERROR the message string is copied with a loop whose only limits are the destination buffer and a NUL byte: ```c /* addons/tftp/nxd_tftp_client.c:1769 */ for (i = 0; (i < (sizeof(tftp_client_ptr -> nx_tftp_client_error_string) - 1)) && (*buffer_ptr); i++) ``` Nothing compares `buffer_ptr` against `nx_packet_append_ptr`. An ERROR packet that carries no terminating NUL, which a server controls completely, walks the loop off the end of the packet until it happens to meet a zero byte or fills the 64 byte destination. ``` ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 at 0x60d0000000c8 thread T4 #0 _nxd_tftp_client_file_read addons/tftp/nxd_tftp_client.c:1769 0x60d0000000c8 is 0 bytes to the right of 136-byte region ``` The open path has the same loop at :1327 and reports the same way. What is read lands in `nx_tftp_client_error_string`, which the applicat
- Product
- NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message.CVE-2026-102720 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.3
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: ```c /* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */ while (i < length - 1) { ... size = *(++data); /* data moves 1: type -> length byte */ data += size + 1; /* data moves size + 1 more */ i += size + 1; /* i moves only size + 1 */ } ``` A TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so the offset falls one byte behind the real read position for every option the walk skips. After enough skipped options the check `i < length - 1` still holds while `data` is already past the end of the message, and the subsequent read of the type and length bytes comes from whatever follows. A single OFFER carrying a long run of skippable options is enough: ``` ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 at 0x61b000000794 thread T5 #0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7
- Product
- eclipse-threadx/netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.