18
CVEs
3
Critical
9
High
0
KEV
0
PoC
9
Unpatched C/H
44.4%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
9
MEDIUM
6
LOW
0
Monthly CVE Trend
Affected Products (30)
Eclipse Theia
9
Eclipse Jetty
8
Eclipse Milo
6
Java
4
Eclipse Glassfish
4
Eclipse Aerios
3
Eclipse Csi Pia
3
Eclipse Openj9
2
Eclipse Basyx
2
Openj9
2
Tomcat
2
Eclipse Ditto
2
Eclipse Open Vsx
2
Eclipse Vert X
2
Eclipse Ankaios
2
Eclipse Arrowhead
2
Eclipse Kuksa Databroker
2
Ssti
1
Eclipse Mojarra
1
Python
1
Eclipse Sw360
1
Eclipse Rdf4J
1
Eclipse Threadx Netx Duo
1
Eclipse Omr
1
Eclipse Basyx Java Server Sdk
1
Eclipse Kura
1
Docker
1
Eclipse Basyx Go Components
1
Kubernetes
1
Eclipse Lyo
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-82180 | Authentication bypass in Eclipse Arrowhead 5.0.0 through 5.2.1 lets an unauthenticated attacker who can publish to the MQTT broker impersonate the cloud's system operator. When the MQTT API runs with the certificate authentication policy, CertificateMqttFilter reads an X.509 certificate straight from the MQTT message payload and trusts its Subject DN without ever verifying the signature or issuer chain, reducing authorization to two string comparisons on public, attacker-controlled values. By minting a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu and dnQualifier=op, the attacker gains isSysOp==true and full management access. No public exploit is identified at time of analysis, but the technique is described in full detail in the advisory. | CRITICAL | 9.5 | 0.2% | 48 |
No patch
|
| CVE-2026-18918 | Authorization bypass in Eclipse Lyo 2.0.0 through 7.0.0 lets remote attackers abuse the 2-legged OAuth flow to promote a self-registered 'provisional' trusted client into a fully trusted one without the required administrator approval. Applications that build their authorization filters on Lyo's AbstractAdapterCredentialsFilter are affected, allowing an attacker to act as a trusted OAuth client and access protected OSLC resources. No public exploit identified at time of analysis, and it is not listed in CISA KEV; fixes shipped in 6.0.1.Final and 7.0.0.Beta3. | CRITICAL | 9.1 | 0.4% | 46 |
|
| CVE-2026-82955 | Improper certificate validation in the KrakenD-based API Gateway of Eclipse aeriOS allows a network man-in-the-middle to compromise bearer-token validation. The bundled KrakenD configuration hard-codes disable_jwk_security to true with no Helm override, so KrakenD skips TLS certificate verification (and in the shipped config fetched the JWKS over plaintext HTTP) when retrieving the JSON Web Key Set used to validate JWTs. Only pre-release development builds are affected; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV. | CRITICAL | 9.0 | 0.1% | 45 |
No patch
|
| CVE-2026-80515 | Authorization bypass in Eclipse Arrowhead 5.0.0-5.2.1 allows any authenticated system - regardless of privilege level - to reach every protected management API endpoint by submitting percent-encoded paths that defeat the raw-URL substring check while still being routed by Spring MVC's decoded dispatcher. Exploiting the flaw is trivial: encoding a single character in '/mgmt/' (e.g. 'm' → '%6D') causes the filter to fall through without authorizing the request, yet Tomcat decodes and dispatches it normally. The highest-impact target is POST /authentication/mgmt/identities, which creates new sysop-level accounts, yielding full administrative takeover of the Arrowhead local cloud. No public exploit has been identified at time of analysis. | HIGH | 8.9 | 0.3% | 44 |
No patch
|
| CVE-2026-82217 | Path traversal in Eclipse Theia 1.73.0-1.74.x AI Agent Mode allows arbitrary file writes outside the workspace with backend OS user privileges through model-supplied paths that bypass workspace-containment checks. The affected tools - writeFileContent, suggestFileContent, and associated replacement and state helpers - accept relative paths such as ../.bashrc, absolute paths, or tilde-expanded paths like ~/.ssh/authorized_keys without boundary validation. Because path arguments derive from LLM output, an indirect prompt injection attack embedded in developer-loaded content can steer writes to host-executed files and escalate to backend code execution; Agent Mode applies writes silently with no confirmation dialog. No public exploit code or CISA KEV listing exists at time of analysis, though the prompt-injection attack surface is realistic in cloud IDE deployments. | HIGH | 8.8 | 0.4% | 44 |
|
| CVE-2026-85199 | Path traversal in Eclipse aeriOS Self-orchestrator prior to version 1.2.1 allows unauthenticated remote attackers to write or delete arbitrary JSON files on the host filesystem by embedding path separator sequences (e.g., '../') in resource identifiers submitted to the REST API. The vulnerability stems from direct string concatenation of user-supplied names into `fs.writeFileSync()` paths without sanitization, confirmed by the upstream commit diff. Real-world impact is amplified by the complete absence of API authentication (PR:N) and by the container running with elevated privileges in the affected deployment, extending the writable filesystem scope beyond the intended `./facts/` directory. No public exploit code has been identified at time of analysis. | HIGH | 8.8 | 0.6% | 44 |
No patch
|
| CVE-2026-19204 | Unauthenticated remote denial-of-service in Eclipse Jetty's WebSocket implementation allows any network-accessible client to exhaust the JVM heap by sending a single WebSocket frame with an unknown opcode and an arbitrarily large declared payload length. When auto-fragmentation is enabled, unknown opcodes bypass the normal maximum frame size check, causing Jetty to attempt heap allocation for the declared payload size before the opcode is ever validated - a logic-ordering flaw classified under CWE-770. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects high impact and low attack barrier; no public exploit has been identified at time of analysis. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-12611 | HTTP/2 thread-exhaustion denial-of-service in Eclipse Jetty allows unauthenticated remote clients to permanently block all server threads by exploiting a race condition in RST_STREAM and GOAWAY frame handling. The race incorrectly resets the `HTTP2Flusher.terminated` field from a non-null terminal state back to null, allowing new write-queue entries to be enqueued in a flusher that will never drain them; the write-blocked threads waiting on those entries hang indefinitely. Across five affected Jetty major branches (9.4, 10.0, 11.0, 12.0, 12.1), any internet-exposed HTTP/2 endpoint is reachable without authentication. No public exploit has been identified at time of analysis. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-84173 | Incorrect authorization in Eclipse Ankaios v0.5.1-v1.0.1 allows an authenticated workload to bypass its scoped access restrictions on the agent-side Control Interface. When the cluster is configured with multi-segment allow rules whose first path segment is a wildcard (e.g., `*.workloads.some_workload`), submitting a CompleteStateRequest or UpdateStateRequest with an empty field mask is incorrectly evaluated as matching the scoped rule, granting the workload full read or write access beyond its authorized state subtree. No public exploit is identified at time of analysis; a patched release (v1.0.2) is available. | HIGH | 8.3 | 0.1% | 42 |
No patch
|
| CVE-2026-84736 | TLS certificate validation is disabled by default in the Federator component of Eclipse aeriOS, enabling man-in-the-middle interception of all outbound HTTPS connections made by the component. Any attacker who can position themselves on the network path between the Federator and external services - including OAuth authorization servers - can impersonate those services and harvest OAuth client credentials and bearer tokens. This affects only the current pre-release development codebase; a source-level fix is confirmed in commit 9c63b60, but no official tagged release exists. No public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 8.3 | 0.2% | 42 |
|
| CVE-2026-19203 | HTTP/1.1 request smuggling in Eclipse Jetty allows unauthenticated remote attackers to desynchronize request boundary parsing between Jetty and an upstream proxy, enabling manipulation of other users' HTTP sessions. The root cause is Jetty's acceptance of a bare LF character (\n) as a line terminator during chunked transfer encoding parsing - specifically in chunk extensions, chunk data termination, or trailer termination - where RFC 7230 mandates CRLF (\r\n). Depending on the Jetty version and configured HTTP compliance mode, a crafted request can cause the proxy and Jetty to disagree on where one request ends and the next begins, enabling request injection against co-located tenants. No public exploit has been identified at time of analysis. | HIGH | 8.3 | 0.3% | 42 |
No patch
|
| CVE-2026-82958 | Template injection in Eclipse Ditto's ImplicitThingCreationMessageMapper (versions 1.3.0 through 3.9.6) allows authenticated connection publishers to override the administrator-configured access policy of a newly provisioned digital twin by embedding JSON-breaking characters in attacker-controlled inbound message headers. The mapper substitutes header placeholder values as raw, unescaped strings into a pre-configured JSON thing-template before parsing, enabling a crafted header value containing a double-quote to escape its string context and inject an inline _policy object - effectively granting the attacker full read/write access to the twin while permanently revoking the legitimate owner's access. Exploitation requires a non-default mapper configuration and a template that reflects attacker-controllable headers; no public exploit code or active exploitation (CISA KEV) has been identified. | HIGH | 7.6 | 0.2% | 38 |
No patch
|
| CVE-2026-85201 | Uncontrolled memory allocation in Eclipse Ankaios 0.1.0-1.0.1 allows a workload with granted Control Interface access to abort the agent process by declaring an arbitrarily large protobuf message length over the Control Interface FIFO, causing unbounded heap allocation and an OOM-triggered process crash. The impact is complete loss of orchestration services for all workloads managed by the affected agent instance. No public exploit has been identified and no active exploitation is confirmed; patch v1.0.2 is available. | MEDIUM | 6.8 | 0.1% | 34 |
No patch
|
| CVE-2026-86590 | Server-side request forgery in Eclipse Che dashboard backend (versions 7.79.0-7.121.0) enables any authenticated user to make the backend issue arbitrary outbound HTTP GET requests to internal network targets, including the cloud instance metadata service at 169.254.169.254, loopback interfaces, RFC-1918 ranges, and in-cluster Kubernetes service endpoints. The POST /dashboard/api/data/resolver endpoint forwards caller-supplied URLs with no host validation and without consulting the operator-configured allowlist (spec.devEnvironments.allowedSources.urls). The vulnerability is fixed in 7.122.0, which introduces private-address blocking, IPv4-mapped IPv6 bypass prevention, allowlist enforcement, and disables outbound redirect following. No public exploit or CISA KEV listing identified at time of analysis. | MEDIUM | 6.3 | 0.4% | 32 |
|
| CVE-2026-79653 | Path traversal in Eclipse SW360's optional filesystem attachment store allows authenticated low-privilege users to write files to arbitrary paths on the host operating system by crafting malicious filenames during attachment upload. Affected versions span 19.0.0 through 20.1.0 exclusively when the non-default `enable.attachment.store.to.file.system` configuration key is active. The CVSS 4.0 score of 6.0 (AT:P, PR:L, VI:H) reflects meaningful integrity impact gated behind a specific configuration requirement; no public exploit has been identified at time of analysis. | MEDIUM | 6.0 | 0.4% | 30 |
|