LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
vendor

Eclipse

26 CVEs published in the last four months and 2 stories. Exploited flaws first.

Critical7
High19
Medium0
Exploited (KEV)0

All recent CVEs

CVECVSSSeverityProductSummaryPublished
CVE-2026-91589.8critical4diac forteIn Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management int127d ago
CVE-2026-164419.6criticalopenj9In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method ha94d ago
CVE-2026-25879.6criticalglassfishA critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism157d ago
CVE-2026-126059.6criticalglassfishIn Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `g78d ago
CVE-2026-25869.1criticalglassfishAn authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console.157d ago
CVE-2026-164399.1criticalopenj9In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow.94d ago
CVE-2026-100509.1criticaljettyIn Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.80d ago
CVE-2026-446918.8hightheiaIn Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g.127d ago
CVE-2026-446888.8hightheiaIn Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part 127d ago
CVE-2026-600098.8hightheiaIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in79d ago
CVE-2026-465808.8hightheiaIn Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace wer127d ago
CVE-2026-95618.2highkuraEclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative sou102d ago
CVE-2026-580808.2highmiloIn Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMappe80d ago
CVE-2026-613877.5highmiloIn Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creat80d ago
CVE-2026-629277.5highmiloIn Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-spac80d ago
CVE-2026-632527.5highmiloIn Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial mess80d ago
CVE-2026-126097.5hightheiaIn Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/host79d ago
CVE-2026-465817.5highmojarraIn Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize a79d ago
CVE-2026-115767.5highthreadx netx duoThe security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT pro127d ago
CVE-2026-100517.5highjettyIn Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent re102d ago
CVE-2026-150757.5highvert.xIn Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler 102d ago
CVE-2026-150767.5highvert.xIn versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Ecli102d ago
CVE-2026-618917.5hightheiaIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download e79d ago
CVE-2026-162437.5highomrIn Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of b94d ago
CVE-2024-77087.5highjettyFor requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.102d ago
CVE-2026-600077.4highmiloIn Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid80d ago

Filter the full tracker by Eclipse →

Our coverage of Eclipse

cloud

Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal

A significant internet outage impacted users in Iceland, Spain, and Portugal on November 27, 2023, attributed to a Border Gateway Protocol (BGP) routing leak. The incident, which began around 10:20 UTC and was largely resolved by 11:15 UTC, caused widespread connectivity issues, particularly affecting the Icelandic government network and various internet service providers (ISPs) in the Iberian…

zero-day

Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’

A new Windows zero-day exploit, dubbed "ShieldBreak," has reportedly been released, allowing any user to elevate their privileges to System-level. The exploit was made public on a recent Patch Tuesday, a day typically associated with the release of security updates from Microsoft. This timing suggests the exploit was either intentionally released to coincide with a presumed patching cycle or…