# Eclipse Foundation vulnerabilities Source: https://junglewise.ai/threats/vendors/eclipse-foundation Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 13:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/eclipse-foundation.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 53 vulnerabilities in Eclipse Foundation: 1 in the last 7 days and 8 in the last 90 days, 8 of them critical and 1 exploited in the wild. The most recent, CVE-2026-123717, was published on 10 November 2026. 5 vulnerabilities in the last four weeks, up 150% on the four before (2). 6 technologies have a page of their own. ## Counts - Last 7 days: 1 - Last 30 days: 6 - Last 90 days: 8 - All time: 53 (8 critical, 1 exploited in the wild) ## About Eclipse Foundation The Eclipse Foundation is a non-profit corporation that provides a governance model and infrastructure for open-source software development projects. ## Latest Eclipse Foundation vulnerabilities - [CVE-2026-123717: Eclipse Otterdog OS command injection in credential providers](https://junglewise.ai/threats/cve-2026-123717-os-command-injection-in-the-pass-and-bitwarden-credential) (info, published 10 Nov 2026) - [CVE-2026-92610: Eclipse esmf-sdk-py-aspect-model-loader path traversal in namespace resolution](https://junglewise.ai/threats/cve-2026-92610-in-esmf-sdk-py-aspect-model-loader-versions-2-1-2-to-2-2-1-the) (info, published 3 Nov 2026) - [CVE-2026-115216: Eclipse ioFog Operator TLS certificate verification bypass](https://junglewise.ai/threats/cve-2026-115216-in-eclipse-iofog-operator-versions-3-8-0-before-3-9-2-tls) (info, published 27 Oct 2026) - [CVE-2026-96402: Eclipse ThreadX USBX heap buffer over-read in PIMA/MTP host](https://junglewise.ai/threats/cve-2026-96402-a-malicious-usb-mtp-ptp-device-can-cause-the-usbx-host-to-read) (info, published 20 Oct 2026) - [CVE-2026-113619: Eclipse ioFog Controller unauthenticated template rendering DoS](https://junglewise.ai/threats/cve-2026-113619-in-eclipse-iofog-controller-versions-3-8-0-through-3-9-1-post) (high, CVSS 7.5, published 20 Oct 2026) - [CVE-2026-102463: Eclipse Vert.x PostgreSQL client unbounded array allocation denial of service](https://junglewise.ai/threats/cve-2026-102463-in-eclipse-vert-x-versions-4-0-0-4-5-34-or-5-0-0-5-0-12-or-5-1-0) (medium, CVSS 5.9, published 15 Oct 2026) - [CVE-2026-102721: Eclipse ThreadX NetX Duo TFTP client heap buffer over-read](https://junglewise.ai/threats/cve-2026-102721-a-tftp-server-that-answers-with-a-short-error-packet-makes-the) (info, published 29 Sep 2026) - [CVE-2026-90882: Open VSX CORS misconfiguration with credential reflection](https://junglewise.ai/threats/cve-2026-90882-the-open-vsx-org-deployment-returned-access-control-allow-origin) (info, published 22 Sep 2026) - [CVE-2026-63252: Eclipse Foundation Eclipse Milo multiple authorization and resource management flaws](https://junglewise.ai/threats/cve-2026-63252-eclipse-foundation-eclipse-milo) (high, CVSS 7.5, published 4 Aug 2026) - [CVE-2026-18353: Eclipse Foundation Eclipse CSI - PIA SSRF via OIDC issuer allowlist bypass](https://junglewise.ai/threats/cve-2026-18353-eclipse-foundation-eclipse-csi-pia-ssrf-via-oidc-issuer-allowlist) (info, CVSS 8.8, published 30 Jul 2026) - [CVE-2026-15704: Eclipse BaSyx Go Components ABAC authorization bypass via trailing slash](https://junglewise.ai/threats/cve-2026-15704-eclipse-basyx-go-components-abac-authorization-bypass-via) (critical, CVSS 9.8, published 24 Jul 2026) - [CVE-2026-10050: Eclipse Jetty auth bypass via ISO-8859-1 encoding in Digest Authentication](https://junglewise.ai/threats/cve-2026-10050-eclipse-jetty-auth-bypass-via-iso-8859-1-encoding-in-digest) (high, CVSS 4, published 22 Jul 2026) - [CVE-2026-16243: Eclipse OMR out-of-bounds read in arraycmp SIMD implementation](https://junglewise.ai/threats/cve-2026-16243-eclipse-omr-out-of-bounds-read-in-arraycmp-simd-implementation) (info, CVSS 5.7, published 21 Jul 2026) - [CVE-2026-16454: Eclipse hawkBit privilege escalation in DDI Controller](https://junglewise.ai/threats/cve-2026-16454-eclipse-hawkbit-privilege-escalation-in-ddi-controller) (medium, CVSS 4.3, published 21 Jul 2026) - [CVE-2026-9561: Eclipse Kura IP spoofing via X-Forwarded-For header](https://junglewise.ai/threats/cve-2026-9561-eclipse-kura-ip-spoofing-via-x-forwarded-for-header) (info, CVSS 8.8, published 14 Jul 2026) - [CVE-2026-8384: Eclipse Jetty path normalization bypass via URI path parameters](https://junglewise.ai/threats/cve-2026-8384-eclipse-jetty-path-normalization-bypass-via-uri-path-parameters) (medium, CVSS 5.3, published 14 Jul 2026) - [CVE-2026-6790: Eclipse Jetty host authority and Host header mismatch](https://junglewise.ai/threats/cve-2026-6790-eclipse-jetty-host-authority-and-host-header-mismatch) (medium, CVSS 5.3, published 14 Jul 2026) - [CVE-2026-57898: Eclipse BaSyx Java Server SDK path traversal in AAS thumbnail API](https://junglewise.ai/threats/cve-2026-57898-eclipse-basyx-java-server-sdk-path-traversal-in-aas-thumbnail-api) (critical, CVSS 9, published 14 Jul 2026) - [CVE-2026-15076: Eclipse Vert.x Web Client cross-domain cookie injection in WebClientSession](https://junglewise.ai/threats/cve-2026-15076-eclipse-vert-x-web-client-cross-domain-cookie-injection-in) (info, CVSS 8.2, published 14 Jul 2026) - [CVE-2026-15075: Eclipse Vert.x sensitive header propagation in HttpClient redirect handler](https://junglewise.ai/threats/cve-2026-15075-eclipse-vert-x-sensitive-header-propagation-in-httpclient) (info, CVSS 8.2, published 14 Jul 2026) - [CVE-2026-13699: Eclipse KUKSA Databroker thread panic in PublishValue gRPC handler](https://junglewise.ai/threats/cve-2026-13699-eclipse-kuksa-databroker-thread-panic-in-publishvalue-grpc) (medium, CVSS 4.3, published 14 Jul 2026) - [CVE-2026-12606: Eclipse Grizzly HTTP request smuggling in trailer header parsing](https://junglewise.ai/threats/cve-2026-12606-eclipse-grizzly-http-request-smuggling-in-trailer-header-parsing) (info, CVSS 6.3, published 14 Jul 2026) - [CVE-2026-10051: Eclipse Jetty information leakage via retained HTTP/1.1 trailers](https://junglewise.ai/threats/cve-2026-10051-eclipse-jetty-information-leakage-via-retained-http-1-1-trailers) (medium, CVSS 4, published 14 Jul 2026) - [CVE-2024-7708: Eclipse Jetty buffer leak in HttpConnection](https://junglewise.ai/threats/cve-2024-7708-eclipse-jetty-buffer-leak-in-httpconnection) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-10055: Eclipse Theia SSRF in request-service RPC](https://junglewise.ai/threats/cve-2026-10055-eclipse-theia-ssrf-in-request-service-rpc) (high, CVSS 8.5, published 3 Jul 2026) ## Most severe Eclipse Foundation vulnerabilities - [CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attack](https://junglewise.ai/threats/cve-2023-44487-http-2-rapid-reset-attack-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 10 Oct 2023) - [CVE-2026-7411: Eclipse BaSyx Java Server SDK path traversal in Submodel HTTP API](https://junglewise.ai/threats/cve-2026-7411-eclipse-basyx-java-server-sdk-path-traversal-in-submodel-http-api) (critical, CVSS 10, published 5 May 2026) - [CVE-2025-67109: Eclipse Cyclone DDS certificate expiration bypass in authentication plugin](https://junglewise.ai/threats/cve-2025-67109-eclipse-cyclone-dds-certificate-expiration-bypass-in) (critical, CVSS 10, published 23 Dec 2025) - [CVE-2024-9342: Eclipse GlassFish improper restriction of login attempts](https://junglewise.ai/threats/cve-2024-9342-eclipse-glassfish-improper-restriction-of-login-attempts) (critical, CVSS 9.8, published 16 Jul 2025) - [CVE-2026-15704: Eclipse BaSyx Go Components ABAC authorization bypass via trailing slash](https://junglewise.ai/threats/cve-2026-15704-eclipse-basyx-go-components-abac-authorization-bypass-via) (critical, CVSS 9.8, published 24 Jul 2026) - [CVE-2026-2587: Eclipse GlassFish EL injection in gadget handler](https://junglewise.ai/threats/cve-2026-2587-eclipse-glassfish-el-injection-in-gadget-handler) (critical, CVSS 9.6, published 19 May 2026) - [CVE-2026-2586: Eclipse GlassFish RCE via EL Injection in Administration Console](https://junglewise.ai/threats/cve-2026-2586-eclipse-glassfish-rce-via-el-injection-in-administration-console) (critical, CVSS 9.1, published 19 May 2026) - [CVE-2026-57898: Eclipse BaSyx Java Server SDK path traversal in AAS thumbnail API](https://junglewise.ai/threats/cve-2026-57898-eclipse-basyx-java-server-sdk-path-traversal-in-aas-thumbnail-api) (critical, CVSS 9, published 14 Jul 2026) - [CVE-2026-10054: Eclipse Theia remote command execution via cross-origin WebSocket access](https://junglewise.ai/threats/cve-2026-10054-eclipse-theia-remote-command-execution-via-cross-origin-websocket) (high, CVSS 8.8, published 3 Jul 2026) - [CVE-2026-7412: Eclipse BaSyx Java Server SDK SSRF in Operation Delegation](https://junglewise.ai/threats/cve-2026-7412-eclipse-basyx-java-server-sdk-ssrf-in-operation-delegation) (high, CVSS 8.6, published 5 May 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, up 150% on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Eclipse Foundation technologies - [Eclipse Foundation Jetty](https://junglewise.ai/threats/technologies/jetty): 9 vulnerabilities - [Eclipse Foundation Theia](https://junglewise.ai/threats/technologies/theia): 6 vulnerabilities - [Eclipse Foundation GlassFish](https://junglewise.ai/threats/technologies/glassfish): 4 vulnerabilities - [Eclipse Foundation Open VSX](https://junglewise.ai/threats/technologies/open-vsx): 4 vulnerabilities - [Eclipse Foundation BaSyx Java Server SDK](https://junglewise.ai/threats/technologies/basyx-java-server-sdk): 3 vulnerabilities - [Eclipse Foundation CSI - PIA](https://junglewise.ai/threats/technologies/csi-pia): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Eclipse Foundation vulnerabilities", https://junglewise.ai/threats/vendors/eclipse-foundation, 10 November 2026.