CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 04/08/2026 |
| CVE-2026-63248 | MEDIO6.5 | In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other act | 04/08/2026 |
| CVE-2026-62927 | ALTO7.5 | In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method. | 04/08/2026 |
| CVE-2026-61387 | ALTO7.5 | In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during dec | 04/08/2026 |
| CVE-2026-60007 | ALTO7.4 | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` re | 04/08/2026 |
| CVE-2026-58080 | ALTO8.2 | In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing a | 04/08/2026 |
| CVE-2026-10050 | CRITICO9.1 | In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.
This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.
If the password contains characters that can | 04/08/2026 |
| CVE-2026-16441 | CRITICO9.6 | In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method. | 21/07/2026 |
| CVE-2026-16439 | CRITICO9.1 | In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow. | 21/07/2026 |
| CVE-2026-16243 | ALTO7.5 | In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero. | 21/07/2026 |
| CVE-2026-16454 | MEDIO4.3 | In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller.
This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates. Under no | 21/07/2026 |
| CVE-2026-9561 | ALTO8.2 | Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 (Web Console) and org.eclipse.kura.rest.provider (REST API) components use this header as the primary IP source when initializin | 14/07/2026 |
| CVE-2026-8384 | MEDIO5.3 | In Eclipse Jetty, an HTTP URI of this form:
/public;/../admin/secret.txt
results in an unresolved path of:
/public/../admin/secret.txt
instead of the expected:
/admin/secret.txt
Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the ali | 14/07/2026 |
| CVE-2026-6790 | MEDIO5.3 | In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).
This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).
This mismatch ca | 14/07/2026 |
| CVE-2026-15076 | ALTO7.5 | In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3.
An attacker who controls any | 14/07/2026 |
| CVE-2026-15075 | ALTO7.5 | In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (scheme, host, port) is performed before copying headers to th | 14/07/2026 |
| CVE-2026-13699 | MEDIO6.5 | In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in PublishValueRequest. When a request contains a valid signal_id but omits data_point, the server directly calls unwrap() on request.data_point, triggering a panic | 14/07/2026 |
| CVE-2026-12606 | MEDIO5.3 | Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set org.glassfish.grizzly.http.STRICT_HEADER_ | 14/07/2026 |