https://vulnogram.org/ Most recent CVEs assigned by Eclipse Foundation (eclipse). https://vulnogram.org/seaview/icons/eclipse.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-93003 https://vulnogram.org/CVE-2026-93003 The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, whi… Medium Network Exploitable Tue, 20 Oct 2026 15:24:53 GMT https://vulnogram.org/CVE-2026-95107 https://vulnogram.org/CVE-2026-95107 A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of… High Tue, 20 Oct 2026 15:20:15 GMT https://vulnogram.org/CVE-2026-94202 https://vulnogram.org/CVE-2026-94202 The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unprove… Medium Tue, 20 Oct 2026 15:19:43 GMT https://vulnogram.org/CVE-2026-95108 https://vulnogram.org/CVE-2026-95108 One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD` control block through `txm_module_object_allocate`; `_txm_module_manager_thread_create` then ta… Medium Tue, 20 Oct 2026 15:19:16 GMT https://vulnogram.org/CVE-2026-94024 https://vulnogram.org/CVE-2026-94024 The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected… Medium Tue, 20 Oct 2026 15:18:28 GMT https://vulnogram.org/CVE-2026-94023 https://vulnogram.org/CVE-2026-94023 A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for *using* an object, a… Medium Tue, 20 Oct 2026 15:18:09 GMT https://vulnogram.org/CVE-2026-95109 https://vulnogram.org/CVE-2026-95109 The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implem… High Tue, 20 Oct 2026 15:17:20 GMT https://vulnogram.org/CVE-2026-94192 https://vulnogram.org/CVE-2026-94192 A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a contro… High Tue, 20 Oct 2026 15:15:06 GMT https://vulnogram.org/CVE-2026-92843 https://vulnogram.org/CVE-2026-92843 A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It… High Network Exploitable Tue, 20 Oct 2026 15:12:55 GMT https://vulnogram.org/CVE-2026-92853 https://vulnogram.org/CVE-2026-92853 The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFF… High Network Exploitable Tue, 20 Oct 2026 15:10:08 GMT https://vulnogram.org/CVE-2026-94018 https://vulnogram.org/CVE-2026-94018 The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed requ… High Network Exploitable Tue, 20 Oct 2026 15:10:08 GMT https://vulnogram.org/CVE-2026-93475 https://vulnogram.org/CVE-2026-93475 The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger m… Critical Network Exploitable Tue, 20 Oct 2026 15:04:30 GMT https://vulnogram.org/CVE-2026-91057 https://vulnogram.org/CVE-2026-91057 `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past the end of the… Medium Tue, 20 Oct 2026 15:01:30 GMT https://vulnogram.org/CVE-2026-92454 https://vulnogram.org/CVE-2026-92454 The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling fac… Medium Tue, 20 Oct 2026 14:58:36 GMT https://vulnogram.org/CVE-2026-91059 https://vulnogram.org/CVE-2026-91059 The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder… Medium Tue, 20 Oct 2026 14:54:37 GMT https://vulnogram.org/CVE-2026-91189 https://vulnogram.org/CVE-2026-91189 The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page… High Tue, 20 Oct 2026 14:53:44 GMT https://vulnogram.org/CVE-2026-92446 https://vulnogram.org/CVE-2026-92446 `gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer… Medium Tue, 20 Oct 2026 14:52:45 GMT https://vulnogram.org/CVE-2026-92449 https://vulnogram.org/CVE-2026-92449 `_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256… Medium Tue, 20 Oct 2026 14:51:24 GMT https://vulnogram.org/CVE-2026-91186 https://vulnogram.org/CVE-2026-91186 The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the f… High Tue, 20 Oct 2026 14:47:52 GMT https://vulnogram.org/CVE-2026-95111 https://vulnogram.org/CVE-2026-95111 A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's `tx_que… Medium Tue, 20 Oct 2026 14:35:40 GMT https://vulnogram.org/CVE-2026-96402 https://vulnogram.org/CVE-2026-96402 A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page. Medium Tue, 20 Oct 2026 14:31:34 GMT https://vulnogram.org/CVE-2026-97400 https://vulnogram.org/CVE-2026-97400 In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbi… Medium Tue, 20 Oct 2026 14:08:17 GMT https://vulnogram.org/CVE-2026-96406 https://vulnogram.org/CVE-2026-96406 A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval de… Medium Tue, 20 Oct 2026 13:17:37 GMT https://vulnogram.org/CVE-2026-96582 https://vulnogram.org/CVE-2026-96582 A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descr… Medium Tue, 20 Oct 2026 13:13:39 GMT https://vulnogram.org/CVE-2026-91041 https://vulnogram.org/CVE-2026-91041 Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver c… High Tue, 20 Oct 2026 13:10:14 GMT https://vulnogram.org/CVE-2026-113620 https://vulnogram.org/CVE-2026-113620 In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups… Critical Network Exploitable Tue, 20 Oct 2026 12:34:08 GMT https://vulnogram.org/CVE-2026-113619 https://vulnogram.org/CVE-2026-113619 In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or… High Network Exploitable Tue, 20 Oct 2026 12:23:27 GMT https://vulnogram.org/CVE-2026-107597 https://vulnogram.org/CVE-2026-107597 PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the approved issuer's… Medium Tue, 20 Oct 2026 10:06:37 GMT https://vulnogram.org/CVE-2026-108062 https://vulnogram.org/CVE-2026-108062 Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service. Medium Network Exploitable Tue, 20 Oct 2026 10:04:35 GMT https://vulnogram.org/CVE-2026-93649 https://vulnogram.org/CVE-2026-93649 In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query parameter an… High Network Exploitable Thu, 15 Oct 2026 13:28:42 GMT https://vulnogram.org/CVE-2026-110723 https://vulnogram.org/CVE-2026-110723 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP… High Network Exploitable Thu, 15 Oct 2026 12:14:08 GMT https://vulnogram.org/CVE-2026-110724 https://vulnogram.org/CVE-2026-110724 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP… High Network Exploitable Thu, 15 Oct 2026 12:11:22 GMT https://vulnogram.org/CVE-2026-110726 https://vulnogram.org/CVE-2026-110726 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP… Medium Thu, 15 Oct 2026 11:58:03 GMT https://vulnogram.org/CVE-2026-18659 https://vulnogram.org/CVE-2026-18659 In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods. Medium Network Exploitable Thu, 15 Oct 2026 09:44:11 GMT https://vulnogram.org/CVE-2026-18662 https://vulnogram.org/CVE-2026-18662 In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in la… Medium Network Exploitable Thu, 15 Oct 2026 09:42:40 GMT https://vulnogram.org/CVE-2026-19864 https://vulnogram.org/CVE-2026-19864 Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently b… Medium Thu, 15 Oct 2026 09:41:25 GMT https://vulnogram.org/CVE-2026-19863 https://vulnogram.org/CVE-2026-19863 An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the log… Critical Network Exploitable Thu, 15 Oct 2026 09:39:26 GMT https://vulnogram.org/CVE-2026-18660 https://vulnogram.org/CVE-2026-18660 In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case. High Network Exploitable Thu, 15 Oct 2026 09:38:02 GMT https://vulnogram.org/CVE-2026-18661 https://vulnogram.org/CVE-2026-18661 In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-patt… High Network Exploitable Thu, 15 Oct 2026 09:01:28 GMT https://vulnogram.org/CVE-2026-77711 https://vulnogram.org/CVE-2026-77711 When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Pro… High Network Exploitable Thu, 15 Oct 2026 08:51:48 GMT https://vulnogram.org/CVE-2026-76184 https://vulnogram.org/CVE-2026-76184 In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`… High Network Exploitable Thu, 15 Oct 2026 08:46:54 GMT https://vulnogram.org/CVE-2026-76182 https://vulnogram.org/CVE-2026-76182 In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI… Medium Network Exploitable Thu, 15 Oct 2026 08:40:58 GMT https://vulnogram.org/CVE-2026-102477 https://vulnogram.org/CVE-2026-102477 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a com… High Network Exploitable Thu, 15 Oct 2026 08:28:25 GMT https://vulnogram.org/CVE-2026-102464 https://vulnogram.org/CVE-2026-102464 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map (qos2inbound) whil… High Network Exploitable Thu, 15 Oct 2026 08:26:02 GMT https://vulnogram.org/CVE-2026-102461 https://vulnogram.org/CVE-2026-102461 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can subm… High Network Exploitable Thu, 15 Oct 2026 08:23:54 GMT https://vulnogram.org/CVE-2026-103224 https://vulnogram.org/CVE-2026-103224 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious,… High Network Exploitable Thu, 15 Oct 2026 08:22:18 GMT https://vulnogram.org/CVE-2026-103223 https://vulnogram.org/CVE-2026-103223 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compr… High Network Exploitable Thu, 15 Oct 2026 08:20:03 GMT https://vulnogram.org/CVE-2026-102466 https://vulnogram.org/CVE-2026-102466 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a server-declared column count with no upper-bound va… High Network Exploitable Thu, 15 Oct 2026 08:15:32 GMT https://vulnogram.org/CVE-2026-102463 https://vulnogram.org/CVE-2026-102463 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit dimension count wi… High Network Exploitable Thu, 15 Oct 2026 08:13:41 GMT https://vulnogram.org/CVE-2026-102469 https://vulnogram.org/CVE-2026-102469 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectIn… Critical Network Exploitable Thu, 15 Oct 2026 08:11:33 GMT