181
CVEs
33
Critical
70
High
1
KEV
59
PoC
39
Unpatched C/H
69.6%
Patch Rate
4.7%
Avg EPSS
Severity Breakdown
CRITICAL
33
HIGH
70
MEDIUM
73
LOW
5
Monthly CVE Trend
Affected Products (30)
Jetty
37
Java
19
Debian Linux
19
Mosquitto
18
Openj9
14
Threadx Usbx
10
Snapcenter
9
Snap Creator Framework
8
Rest Data Services
8
Threadx Netx Duo
8
Theia
8
E Series Santricity Os Controller
7
Vert X
7
Communications Session Route Manager
7
Communications Services Gatekeeper
7
Communications Element Manager
6
Element Plug In For Vcenter Server
6
Siebel Core Automation
6
E Series Santricity Web Services
6
Retail Xstore Point Of Service
5
Virtual Storage Console
5
Storage Replication Adapter For Clustered Data Ontap
5
Active Iq Unified Manager
5
Communications Cloud Native Core Policy
5
Santricity Cloud Connector
5
Vasa Provider For Clustered Data Ontap
5
Fedora
5
Kura
5
Autovue For Agile Product Lifecycle Management
5
Communications Session Report Manager
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2023-44487 | Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected. | HIGH | 7.5 | 94.4% | 202 |
KEV
PoC
|
| CVE-2015-2080 | The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 92.4%. | HIGH | 7.5 | 92.4% | 150 |
PoC
|
| CVE-2026-1699 | Supply chain vulnerability in Eclipse Theia GitHub Actions workflow. The preview.yml workflow uses pull_request_target with checkout, enabling malicious PRs to steal secrets. CVSS 10.0, PoC available. | CRITICAL | 10.0 | 0.0% | 70 |
PoC
No patch
|
| CVE-2021-32834 | Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.9 | 0.9% | 70 |
PoC
No patch
|
| CVE-2021-32835 | Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.9 | 4.6% | 70 |
PoC
No patch
|
| CVE-2018-12542 | In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\'. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 2.3% | 69 |
PoC
|
| CVE-2021-34427 | In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 57.7% | 69 |
PoC
No patch
|
| CVE-2022-36063 | Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX-supported processors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 1.5% | 69 |
PoC
|
| CVE-2023-4760 | In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 1.0% | 69 |
PoC
|
| CVE-2024-0740 | Eclipse Target Management: Terminal and Remote System Explorer (RSE) version <= 4.5.400 has a remote code execution vulnerability that does not require authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 1.2% | 69 |
PoC
|
| CVE-2024-10838 | An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | HIGH | 8.8 | 1.1% | 65 |
PoC
|
| CVE-2018-12540 | In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 2.0% | 64 |
PoC
|
| CVE-2019-18213 | XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows XXE via a crafted XML document, with. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | HIGH | 8.8 | 2.0% | 64 |
PoC
|
| CVE-2019-17633 | For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.8% | 64 |
PoC
No patch
|
| CVE-2021-34435 | In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.6% | 64 |
PoC
|