Vendor
Eclipse vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 133 vulnerabilities in Eclipse: 12 in the last 7 days and 91 in the last 90 days, 11 of them critical and 1 exploited in the wild. The most recent, CVE-2026-97891, was published on 10 November 2026. 52 vulnerabilities in the last four weeks, up 271% on the four before (14). 2 critical against 1. 11 technologies have a page of their own.
- Last 7 days
- 12
- Last 90 days
- 91
- Critical, all time
- 11
- Exploited in the wild
- 1
About Eclipse
Eclipse is an open-source integrated development environment and platform for building software tools and applications.
Eclipse technologies
Latest Eclipse vulnerabilities
- CVE-2026-97891: Eclipse Kura Web Console session exhaustion denial of serviceinfo
- CVE-2026-97401: Eclipse Kura privilege escalation in CommandCloudApp ZIP extractioninfo
- CVE-2026-112186: Eclipse Kura Service Listing V1 unauthenticated denial of serviceinfo
- CVE-2026-112185: Eclipse Kura Configuration REST API authorization bypassinfo
- CVE-2026-111729: Eclipse Kura path traversal in command file-upload handlerinfo
- CVE-2026-97402: Eclipse Kura BLE advertisement decoder infinite loopinfo
- CVE-2026-112191: Eclipse Kura Identity REST APIs privilege escalationinfo
- CVE-2026-114359: Eclipse Kura unrestricted deployment package download sizeinfo
- CVE-2026-113422: Eclipse Kura privilege escalation in Wire Graph updateinfo
- CVE-2026-124683: Eclipse Langium algorithmic complexity DoS in IndentationAwareTokenBuilderinfo
- CVE-2026-118492: Eclipse Langium langium-sprotty XSS in diagnostic messagesinfo
- CVE-2026-123870: Otterdog webhook arbitrary code execution via eval()info
- CVE-2026-123059: Eclipse BaSyx Helm Charts cleartext OAuth2 client secret in ConfigMaphighCVSS 7.5
- CVE-2026-120421: Eclipse Mojarra reflected XSS in URL client window modemediumCVSS 6.1
- CVE-2026-118487: Eclipse Vert.x STOMP FrameParser heap exhaustionhighCVSS 7.5
- CVE-2026-118489: Eclipse Vert.x CachingWebClient cross-user cache disclosurehighCVSS 7.5
- CVE-2026-118488: Eclipse Vert.x Redis client unbounded buffer allocationmediumCVSS 5.9
- CVE-2026-89295: Eclipse Mnestix AAS Generator unbounded memory allocation in ID generation endpointinfo
- CVE-2026-89293: Eclipse Mnestix Browser missing authorization in admin server actionsinfo
- CVE-2026-89292: Eclipse Mnestix Browser unauthenticated SSRF with API key disclosureinfo
- CVE-2026-115231: Eclipse ThreadX Module Manager privilege escalation via forged callbackinfo
- CVE-2026-113421: Eclipse ThreadX Modules use-after-free in trace-buffer callbackinfo
- CVE-2026-115403: Eclipse ThreadX NetX Duo NULL pointer dereference in IPv6 raw socket sendinfo
- CVE-2026-115215: Eclipse ThreadX NetX Duo DTLS session pool exhaustioninfo
- CVE-2026-115654: Eclipse ThreadX Module Manager missing authorization in thread controlinfo
Most severe Eclipse vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attackcriticalexploited in the wildCVSS 5.3EPSS 100.0%
- CVE-2025-67109: Eclipse Cyclone DDS certificate expiration bypass in authentication plugincriticalCVSS 10EPSS 0.3%
- CVE-2025-55089: In FileX before 6.4.2, the file support module for Eclipse Foundation ThreadX, there was a possible buffer overflow in…criticalCVSS 9.8EPSS 0.5%
- CVE-2025-55086: In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client…criticalCVSS 9.8EPSS 0.4%
- CVE-2026-114278: Eclipse Che che-machine-exec command injection vulnerabilitycriticalCVSS 9.8
- CVE-2026-113620: Eclipse ioFog Controller WebSocket authentication bypass in exec and log routescriticalCVSS 9.8
- CVE-2026-24457: Eclipse OpenMQ arbitrary file read via unsafe configuration parsingcriticalCVSS 9.1EPSS 0.6%
- CVE-2025-55100: In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read…criticalCVSS 9.1EPSS 0.6%
- CVE-2026-78299: Eclipse Embedded CDT path traversal in CMSIS-Pack extractioncriticalCVSS 9.1EPSS 0.5%
- CVE-2025-55081: In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function…criticalCVSS 9.1EPSS 0.4%
Vulnerabilities per week
52 vulnerabilities in the last four weeks, up 271% on the four before (14). 2 critical against 1. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 2 | 0 | |
| 31 Aug 2026 | 7 | 0 | |
| 7 Sep 2026 | 4 | 0 | |
| 14 Sep 2026 | 4 | 1 | |
| 21 Sep 2026 | 1 | 0 | |
| 28 Sep 2026 | 8 | 0 | |
| 5 Oct 2026 | 1 | 0 | |
| 12 Oct 2026 | 19 | 0 | |
| 19 Oct 2026 | 16 | 1 | |
| 26 Oct 2026 | 2 | 1 | |
| 2 Nov 2026 | 15 | 0 | |
| 9 Nov 2026 | 12 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Eclipse vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/eclipse)<a href="https://junglewise.ai/threats/vendors/eclipse"><img src="https://junglewise.ai/threats/vendors/eclipse/badge.svg" alt="Eclipse vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/eclipse.json, and this page as text at https://junglewise.ai/threats/vendors/eclipse.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Eclipse vulnerabilities", https://junglewise.ai/threats/vendors/eclipse, 13 November 2026.