Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
471 results · page 1 of 10
Oct 28, 2026The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/CVE-2026-114278 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.8
The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).
- Product
- Eclipse Che
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 27, 2026In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`CVE-2026-115408 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.5
In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`, `FindMLKEMKeyPairsWithAttributes`) locate the public half of an ML-KEM key pair by `CKA_ID`/`CKA_LABEL` and never verify it against the private key. In addition, the "ID only" fallback search runs even when the private key has no `CKA_ID`, so the search template reduces to the public-key class and the ML-KEM key type and the first ML-KEM public key on the token is returned. `Encapsulate()` on the resulting key pair encrypts the fresh shared secret to that key, so its owner — not the holder of the private key the caller looked up — can recover the secret. An attacker who can open an unauthenticated session on the token and plant a public `CKK_ML_KEM` object carrying the victim's `CKA_ID`/`CKA_LABEL` receives the shared secrets for encapsulations performed through the substituted key pair, compromising the confidentiality of those secrets and of everything protected by keys derived from them. The v1 module paths have no ML-KEM support and are not affected.
- Product
- Eclipse KeyPont
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs iCVE-2026-115216 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.1
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.
- Product
- Eclipse ioFog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 27, 2026In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are CVE-2026-113644 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.5
In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cert` on supported releases; `iofog-agent provision` and `iofog-agent cert` on older releases) that run over SSH on a remote agent host and via a local shell. A party who can change that API response can include shell metacharacters and cause the operator's CLI to run additional commands on the agent host when the operator deploys or attaches an agent. This is fixed in version 3.9.2.
- Product
- Eclipse ioFog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026`HmacShaCryptor.Hash` never hashed its input.CVE-2026-89320 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.8
`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.
- Product
- Eclipse KeyPont - GOSE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation.CVE-2026-89319 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.
- Product
- Eclipse KeyPont - GOSE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length.CVE-2026-89318 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.
- Product
- Eclipse KeyPont - GOSE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it.CVE-2026-89317 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.
- Product
- Eclipse KeyPont - GOSE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`.CVE-2026-89316 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**.
- Product
- Eclipse KeyPont - GOSE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim.CVE-2026-89315 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.
- Product
- Eclipse KeyPont - GOSE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry counCVE-2026-89314 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.
- Product
- Eclipse KeyPont - GOSE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache.CVE-2026-89313 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".
- Product
- Eclipse KeyPont - GOSE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length.CVE-2026-89312 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.
- Product
- Eclipse KeyPont - GOSE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and CVE-2026-110938 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).
- Product
- Eclipse OpenJ9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 21, 2026In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and CVE-2026-111075 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network payload that triggers an unsigned integer underflow in `DataDescriptor::getPayloadSize()` and `DataDescriptor::getNextDescriptor()`. This results in an out-of-bounds heap read and an immediate process crash (SIGSEGV), causing a denial of service.
- Product
- Eclipse OpenJ9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 21, 2026In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service.CVE-2026-111074 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving compilation worker thread to enter an infinite loop consuming ~100% CPU. An unauthenticated remote attacker can exploit this by opening a small number of crafted TCP connections to exhaust the entire worker thread pool, silently halting compilation services for all connected client JVMs.
- Product
- Eclipse OpenJ9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 20, 2026The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte.CVE-2026-95109 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.5
The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and asked the MMU a single question about the start. A memory-protected module therefore passed any range whose first byte was user-readable, however far the rest of it reached. Privileged dispatch code then read or wrote the whole range. Because every protected-module dispatcher that consumes a buffer or an extra-parameter array goes through this one macro, the defect is not in any individual service: it is in the primitive all of them rely on.
- Product
- Eclipse ThreadX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one.CVE-2026-95108 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.8
One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD` control block through `txm_module_object_allocate`; `_txm_module_manager_thread_create` then takes a second allocation of `TXM_MODULE_KERNEL_STACK_SIZE` bytes for the privileged kernel stack that thread's system calls run on, and records it in the control block. Both come from `_txm_module_manager_object_pool` and both are linked onto the module's allocation list. The Module Manager's thread-delete dispatcher released only the first. The kernel stack stayed allocated until the whole module was stopped, so a module that creates, terminates and deletes threads in a loop — every state transition valid, every service returning `TX_SUCCESS` — removed a fixed block from a finite pool shared by the manager and by every other loaded module, on every cycle, for as long as it stayed loaded. Once the pool is exhausted, no memory-protected module can create any kernel object and no user-mode module thread can be created anywhere in the system. Vulnerable function: `_txm_module_manager_tx_thread_delete_dispatch`, in `common_modules/modu
- Product
- Eclipse ThreadX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`.CVE-2026-95107 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7
A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a `ULONG` wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.
- Product
- Eclipse ThreadX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module supplies lay inside CVE-2026-94202 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 4.8
The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved words is read by the dispatcher's own buffer check, which takes index 1 as the pool start and index 2 as the length to range-check it over. So the out-of-bounds read is performed by the validation code itself, before the kernel service is reached, and the size the caller's pool start is then validated against is a word the manager has not proved the module owns. The other unproved word is read when the service's argument list is built. Vulnerable function: `_txm_module_manager_tx_block_pool_create_dispatch`, in `common_modules/module_manager/inc/txm_module_manager_dispatch.h`.
- Product
- Eclipse ThreadX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txmCVE-2026-94192 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.5
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.
- Product
- Eclipse ThreadX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privilCVE-2026-94024 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended `txm_module_object_pointer_get_extended` is handed a length and does not use it to bound the buffer, and the deprecated `txm_module_object_pointer_get` supplies the largest value a `UINT` can hold, so it removes the bound rather than lacking one. A module can make the walk unbounded without knowing anything about the memory it reaches, and where the walk reaches memory a privileged read cannot take, the resulting fault leaves the kernel unable to preempt for the rest of the system's life. Vulnerable functions: `_txm_module_manager_txm_module_object_pointer_get_dispatch`, `_txm_module_manager_txm_module_object_pointer_get_extended_dispatch` (both in `common_modules/module_manager/inc/txm_module_manager_dispatch.h`) and `_txm_module_manager_object_name_compare` (`common_modules/module_manager/src/txm_module_manager_util.c`).
- Product
- Eclipse ThreadX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the objeCVE-2026-94023 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for *using* an object, and using an object a module does not own is supported and intended — `txm_module_object_pointer_get_extended` searches the system's created objects by name and hands back objects the application created and objects other modules created, so that a module can send to a shared queue, take a shared semaphore or get a shared mutex. Destroying one of those is not sharing it. A module could name any object it had a pointer to and have the privileged dispatcher delete it.
- Product
- Eclipse ThreadX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request.CVE-2026-94018 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.8
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.
- Product
- Eclipse ThreadX - NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for thCVE-2026-93475 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.3
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification. It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.
- Product
- Eclipse ThreadX - NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section.CVE-2026-93003 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing decisions it should not be able to reach.
- Product
- Eclipse ThreadX - NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a bytCVE-2026-92853 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer. The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.
- Product
- Eclipse ThreadX - NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsCVE-2026-92843 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.
- Product
- Eclipse ThreadX - NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage retuCVE-2026-91057 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 4.6
`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in `_gx_multi_line_text_view_string_total_rows_compute()` and a row of text that is not in the source.
- Product
- Eclipse ThreadX - GUIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machinCVE-2026-97400 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.8
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
- Product
- Eclipse OpenJ9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 20, 2026A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the applCVE-2026-96402 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.2
A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.
- Product
- Eclipse ThreadX - USBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queuCVE-2026-95111 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 4.8
A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's `tx_queue_message_size` is a count of `ULONG`s and the copy moves that many words, so the extent is `message_size * sizeof(ULONG)` bytes. The front-send dispatcher passed the word count itself. `tx_queue_send` and `tx_queue_receive`, either side of it in the same header, have always multiplied. A source buffer ending `message_size` bytes into memory the module may read was therefore accepted, and `_txe_queue_front_send` then read `message_size * sizeof(ULONG)` bytes from it in privileged mode — `3 * message_size` bytes past the end of what the module is allowed to read. The words are written into the queue's message area, so a module that can receive from that queue reads them back.
- Product
- Eclipse ThreadX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads.CVE-2026-92454 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.8
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which `GX_SOFTWARE_DECODER_SUPPORT` is enabled.
- Product
- Eclipse ThreadX - GUIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and nCVE-2026-92449 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.8
`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller, so the loader corrupts its own arena. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this. Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.
- Product
- Eclipse ThreadX - GUIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry onCVE-2026-92446 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.8
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded. This is a distinct defect from GHSA-hgcj-22cg-4hfv, which was an underflowed glyph count. It needs no underflow and no wrapped multiply: a perfectly well-formed, narrow glyph range reaches it.
- Product
- Eclipse ThreadX - GUIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The GUIX binary resource loader never checks that a font page's glyph range is well formed.CVE-2026-91189 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.1
The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count. That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.
- Product
- Eclipse ThreadX - GUIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The PNG chunk reader has no notion of chunk ordering.CVE-2026-91186 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.4
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one after IDAT rewrites the image width, height, bit depth and pixel depth *after* the decoded-data buffer has already been allocated and filled from the original values. The pass that reverses the PNG row filters then derives its own extent from the new dimensions and walks the old allocation, moving image bytes past the end of it. The buffer is allocated by GUIX rather than supplied by the caller, so the application has no way to size it defensively. The decoder is compiled in by default.
- Product
- Eclipse ThreadX - GUIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The GUIX JPEG software decoder enforces no ordering on JPEG markers.CVE-2026-91059 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.8
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a `GX_PIXELMAP` whose reported dimensions and `data_size` exceed the allocation behind it. Any consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path. Reproduces in the shipped default configuration; `GX_SOFTWARE_DECODER_SUPPORT` is enabled by default.
- Product
- Eclipse ThreadX - GUIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow.CVE-2026-96582 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 4.9
A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor only **after** it had advanced past the header and parsed the payload, and the item analysis it relied on never measured the declared sizes against the bytes actually received. A HID peripheral returning a short report descriptor therefore drove a heap out-of-bounds read during ordinary enumeration.
- Product
- Eclipse ThreadX - USBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header.CVE-2026-96406 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 4.9
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the configuration descriptor actually received. A device that reports a `wTotalLength` larger than the descriptors it supplies therefore had its own claim believed. Once the real bytes ran out the walk kept going, dereferencing the cursor past the end of the configuration buffer, in the host's context, whenever the application queried format or frame data.
- Product
- Eclipse ThreadX - USBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay.CVE-2026-91041 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.8
Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver callback, giving control of the instruction pointer.
- Product
- Eclipse ThreadX - FileX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT.CVE-2026-113620 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.8
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.
- Product
- Eclipse ioFog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.eclipse.orggitlab.eclipse.org
Oct 20, 2026In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped LiCVE-2026-113619 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.5
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.
- Product
- Eclipse ioFog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.eclipse.orggitlab.eclipse.org
Oct 20, 2026Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.CVE-2026-108062 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.
- Product
- Eclipse CSI - PIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 20, 2026PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` containeCVE-2026-107597 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.1
PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the field is non-empty (`pia/oidc.py:42-52`). An approved identity provider — and every registered per-project Jenkins instance under `https://ci.eclipse.org/<project>/oidc` is a separate such party (`pia/models.py`) — can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext `http`, from PIA's own network position. The fetch happens before any signature is verified, as a side effect of an unauthenticated `POST /v1/upload/sbom` request that is ultimately rejected with 401.
- Product
- Eclipse CSI - PIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 15, 2026In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the posCVE-2026-93649 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.5
In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta http-equiv="refresh". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine "Thank you for downloading Eclipse Temurin" page while their browser downloads a binary of the attacker's choosing
- Product
- Adoptium Temurin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element CVE-2026-110724 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.5
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
- Product
- Eclipse Connected Services Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element CVE-2026-110723 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 7.5
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
- Product
- Eclipse Connected Services Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element CVE-2026-110726 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.5
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
- Product
- Eclipse Connected Services Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object.CVE-2026-19864 · Other software · reported by emo@eclipse.orgMedium 5.6
Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.