6
CVEs
0
Critical
2
High
0
KEV
1
PoC
0
Unpatched C/H
66.7%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
2
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (30)
Jetty
37
Java
19
Debian Linux
19
Mosquitto
18
Openj9
14
Threadx Usbx
10
Snapcenter
9
Snap Creator Framework
8
Rest Data Services
8
Threadx Netx Duo
8
Theia
8
E Series Santricity Os Controller
7
Vert X
7
Communications Session Route Manager
7
Communications Services Gatekeeper
7
Communications Element Manager
6
Element Plug In For Vcenter Server
6
Siebel Core Automation
6
E Series Santricity Web Services
6
Retail Xstore Point Of Service
5
Virtual Storage Console
5
Storage Replication Adapter For Clustered Data Ontap
5
Active Iq Unified Manager
5
Communications Cloud Native Core Policy
5
Santricity Cloud Connector
5
Vasa Provider For Clustered Data Ontap
5
Fedora
5
Kura
5
Autovue For Agile Product Lifecycle Management
5
Communications Session Report Manager
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-6860 | Wildcard TLS certificate validation in Eclipse Vert.x allows remote attackers to bypass Server Name Indication (SNI) hostname verification by presenting arbitrary subdomains matching wildcard patterns, potentially disclosing sensitive server configuration and enabling certificate reuse across unintended service endpoints. The vulnerability affects Vert.x versions using unbounded SNI cache mechanisms without proper hostname validation constraints, and is fixed by implementing bounded LRU caching with proper synchronization and hostname matching enforcement. | MEDIUM | 6.9 | 0.0% | 55 |
PoC
|
| CVE-2026-60009 | Unauthenticated arbitrary file write in Eclipse Theia 1.73.1 and earlier (browser-mode deployments) allows any cross-origin web page to overwrite files at any absolute path the backend process can access, with a realistic escalation to remote code execution. The `POST /file-upload` handler in `@theia/filesystem` accepts attacker-controlled absolute paths with no workspace boundary check, while a distinct HTTP middleware flaw in `@theia/core` lets the connection token check pass without rejection for tokenless HTTP requests. Because `multipart/form-data` is a CORS-safelisted request type, browsers send the exploit request cross-origin with no preflight and no credentials. No public exploit has been identified at time of analysis, and no CISA KEV listing appears in the provided data, but the attack mechanism is straightforward and requires only that a victim visit an attacker-controlled page. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-12609 | Path traversal in Eclipse Theia's plugin-hosting HTTP endpoint (versions 1.66.0 through 1.73.1) enables unauthenticated remote attackers to exfiltrate arbitrary files readable by the Theia backend process by injecting percent-encoded directory traversal sequences. The `/hostedPlugin/:pluginId/:path(*)` endpoint passes user-supplied path data directly into `path.resolve()` without subsequently verifying the resolved path stays within the plugin directory boundary. Critically, because plugin IDs are deterministically derived from publisher and plugin name, an attacker can use well-known built-in plugins as traversal anchors without any prior reconnaissance of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.4% | 38 |
|
| CVE-2026-14574 | Prototype pollution in Eclipse Theia's preference resolution system exposes developers to application-logic manipulation when opening crafted workspaces. The `PreferenceUtils.merge` function in `@theia/core`, invoked for every preference scope resolution, fails to reject reserved JavaScript prototype keys (`__proto__`, `constructor`, `prototype`), allowing a malicious `.theia/settings.json` or `.vscode/settings.json` to corrupt `Object.prototype` across the entire Theia Node.js process. Affected versions span 0.7.0 through 1.73.1 inclusive; no public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.7 appropriately reflects the social-engineering dependency and required user interaction. | MEDIUM | 5.7 | 0.1% | 29 |
|
| CVE-2026-9158 | Use-after-free in Eclipse 4diac FORTE versions 3.0.0-3.1.0 allows adjacent, unauthenticated attackers to corrupt process memory by sending a specially crafted DELETE connection command to the management interface, leaving a dangling pointer exploitable by subsequent commands. The impact spans memory integrity corruption and availability loss (runtime crash), with a minor confidentiality exposure from stale freed-memory reads - meaningful risks in industrial automation deployments where FORTE orchestrates IEC 61499 distributed control logic. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS 4.0 supplemental Safety metric is marked Partial (S:P), flagging potential downstream safety consequences in OT environments. | MEDIUM | 5.2 | 0.2% | 26 |
No patch
|
| CVE-2026-14304 | XML External Entity (XXE) injection in Eclipse Accessibility Tools Framework (ACTF) versions through 1.6.0 and miChecker through 3.1.0 allows a local attacker to exfiltrate files and probe internal network resources by supplying a maliciously crafted XML document to a user running an ACTF-based application. Exploitation requires user interaction - the victim must open or process the attacker-supplied XML - but no special privileges are required. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 4.6 reflects the limited, read-only confidentiality impact scoped to local and internal resources. | MEDIUM | 4.6 | 0.1% | 23 |
No patch
|