18
CVEs
5
Critical
5
High
0
KEV
3
PoC
5
Unpatched C/H
55.6%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
5
MEDIUM
7
LOW
1
Monthly CVE Trend
Affected Products (30)
Jetty
37
Java
19
Debian Linux
19
Mosquitto
18
Openj9
14
Threadx Usbx
10
Snapcenter
9
Snap Creator Framework
8
Rest Data Services
8
Threadx Netx Duo
8
Theia
8
E Series Santricity Os Controller
7
Vert X
7
Communications Session Route Manager
7
Communications Services Gatekeeper
7
Communications Element Manager
6
Element Plug In For Vcenter Server
6
Siebel Core Automation
6
E Series Santricity Web Services
6
Retail Xstore Point Of Service
5
Virtual Storage Console
5
Storage Replication Adapter For Clustered Data Ontap
5
Active Iq Unified Manager
5
Communications Cloud Native Core Policy
5
Santricity Cloud Connector
5
Vasa Provider For Clustered Data Ontap
5
Fedora
5
Kura
5
Autovue For Agile Product Lifecycle Management
5
Communications Session Report Manager
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-1699 | Supply chain vulnerability in Eclipse Theia GitHub Actions workflow. The preview.yml workflow uses pull_request_target with checkout, enabling malicious PRs to steal secrets. CVSS 10.0, PoC available. | CRITICAL | 10.0 | 0.0% | 70 |
PoC
No patch
|
| CVE-2026-6860 | Wildcard TLS certificate validation in Eclipse Vert.x allows remote attackers to bypass Server Name Indication (SNI) hostname verification by presenting arbitrary subdomains matching wildcard patterns, potentially disclosing sensitive server configuration and enabling certificate reuse across unintended service endpoints. The vulnerability affects Vert.x versions using unbounded SNI cache mechanisms without proper hostname validation constraints, and is fixed by implementing bounded LRU caching with proper synchronization and hostname matching enforcement. | MEDIUM | 6.9 | 0.0% | 55 |
PoC
|
| CVE-2025-67109 | Certificate-validation bypass in Eclipse Cyclone DDS before 0.10.5 lets unauthenticated network attackers defeat the DDS Security authentication plugin's certificate checks, and per the advisory execute commands with System privileges. The flaw stems from improper verification of certificate time/expiration (CWE-298), meaning expired or otherwise time-invalid certificates can be accepted as valid, enabling impersonation of trusted DDS participants. The EPSS score is low (0.30%, 22nd percentile) and there is no CISA KEV listing, so despite the maximal 10.0 CVSS there is no confirmed active exploitation at time of analysis. | CRITICAL | 10.0 | 0.3% | 50 |
No patch
|
| CVE-2026-24457 | Arbitrary file read in Eclipse Open Message Queue (OpenMQ) lets a remote attacker retrieve any file readable by the broker process by abusing unsafe parsing of the broker configuration, a path-traversal (CWE-22) weakness. Any network-exposed OpenMQ broker is affected without authentication, and the vendor notes that in some deployments the file-read primitive can be escalated to remote code execution. There is no public exploit identified at time of analysis, EPSS is low (0.26%, 49th percentile), and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-1188 | Buffer size miscalculation in Eclipse OMR port library since 0.2.0. An API function returning processor feature names has incorrect size allocation. Patch available. | CRITICAL | 9.8 | 0.0% | 49 |
|
| CVE-2026-1002 | Improper URI path normalization in Vert.x Web's static file handler allows remote attackers to manipulate the cache and deny access to static files through specially crafted request URIs containing encoded path traversal sequences. An unauthenticated attacker can exploit this vulnerability over the network with no user interaction to cause denial of service by returning HTTP 404 responses for normally accessible files. Public exploit code exists and patches are available. | MEDIUM | 5.3 | 0.0% | 47 |
PoC
|
| CVE-2026-60009 | Unauthenticated arbitrary file write in Eclipse Theia 1.73.1 and earlier (browser-mode deployments) allows any cross-origin web page to overwrite files at any absolute path the backend process can access, with a realistic escalation to remote code execution. The `POST /file-upload` handler in `@theia/filesystem` accepts attacker-controlled absolute paths with no workspace boundary check, while a distinct HTTP middleware flaw in `@theia/core` lets the connection token check pass without rejection for tokenless HTTP requests. Because `multipart/form-data` is a CORS-safelisted request type, browsers send the exploit request cross-origin with no preflight and no credentials. No public exploit has been identified at time of analysis, and no CISA KEV listing appears in the provided data, but the attack mechanism is straightforward and requires only that a victim visit an attacker-controlled page. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2025-55102 | A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service. | HIGH | 8.7 | 0.0% | 44 |
No patch
|
| CVE-2026-0648 | Memory corruption in ThreadX RTOS CreateCounter() function allows local attackers with user privileges to trigger hard faults or corrupt kernel memory by exhausting the counter pool, which causes an unchecked error code to be cast as a wild pointer. The vulnerability stems from incorrect error validation logic that fails to detect counter allocation failures, enabling subsequent writes to arbitrary memory addresses. No patch is currently available. | HIGH | 7.8 | 0.0% | 39 |
No patch
|
| CVE-2026-12609 | Path traversal in Eclipse Theia's plugin-hosting HTTP endpoint (versions 1.66.0 through 1.73.1) enables unauthenticated remote attackers to exfiltrate arbitrary files readable by the Theia backend process by injecting percent-encoded directory traversal sequences. The `/hostedPlugin/:pluginId/:path(*)` endpoint passes user-supplied path data directly into `path.resolve()` without subsequently verifying the resolved path stays within the plugin directory boundary. Critically, because plugin IDs are deterministically derived from publisher and plugin name, an attacker can use well-known built-in plugins as traversal anchors without any prior reconnaissance of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.4% | 38 |
|
| CVE-2026-1605 | Eclipse Jetty 12.0.0 through 12.0.31 and 12.1.0 through 12.1.5 suffer from a denial-of-service vulnerability in GzipHandler where decompressor resources leak when processing gzip-compressed requests that generate uncompressed responses. An unauthenticated remote attacker can exhaust server memory by repeatedly sending compressed requests, causing service degradation or unavailability. No patch is currently available. | HIGH | 7.5 | 0.1% | 38 |
|
| CVE-2026-14574 | Prototype pollution in Eclipse Theia's preference resolution system exposes developers to application-logic manipulation when opening crafted workspaces. The `PreferenceUtils.merge` function in `@theia/core`, invoked for every preference scope resolution, fails to reject reserved JavaScript prototype keys (`__proto__`, `constructor`, `prototype`), allowing a malicious `.theia/settings.json` or `.vscode/settings.json` to corrupt `Object.prototype` across the entire Theia Node.js process. Affected versions span 0.7.0 through 1.73.1 inclusive; no public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.7 appropriately reflects the social-engineering dependency and required user interaction. | MEDIUM | 5.7 | 0.1% | 29 |
|
| CVE-2025-10543 | A security vulnerability in Eclipse Paho Go MQTT (CVSS 5.3). Remediation should follow standard vulnerability management procedures. | MEDIUM | 5.3 | 0.0% | 27 |
|
| CVE-2026-9158 | Use-after-free in Eclipse 4diac FORTE versions 3.0.0-3.1.0 allows adjacent, unauthenticated attackers to corrupt process memory by sending a specially crafted DELETE connection command to the management interface, leaving a dangling pointer exploitable by subsequent commands. The impact spans memory integrity corruption and availability loss (runtime crash), with a minor confidentiality exposure from stale freed-memory reads - meaningful risks in industrial automation deployments where FORTE orchestrates IEC 61499 distributed control logic. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS 4.0 supplemental Safety metric is marked Partial (S:P), flagging potential downstream safety consequences in OT environments. | MEDIUM | 5.2 | 0.2% | 26 |
No patch
|
| CVE-2026-14304 | XML External Entity (XXE) injection in Eclipse Accessibility Tools Framework (ACTF) versions through 1.6.0 and miChecker through 3.1.0 allows a local attacker to exfiltrate files and probe internal network resources by supplying a maliciously crafted XML document to a user running an ACTF-based application. Exploitation requires user interaction - the victim must open or process the attacker-supplied XML - but no special privileges are required. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 4.6 reflects the limited, read-only confidentiality impact scoped to local and internal resources. | MEDIUM | 4.6 | 0.1% | 23 |
No patch
|