3833 matches found
PT-2026-66364
Name of the Vulnerable Software and Affected Versions Spring Tools for Eclipse versions prior to 5.2.1 Spring Tools for VSCode / Cursor / Theia versions prior to 2.2.1 Description Starting Spring Boot applications in Spring Tools with the live information mode enabled allows for remote code...
cve-2026-59327 - MEDIUM - CVE-2026-59327: Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations
Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...
cve-2026-59328 - MEDIUM - CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips
Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...
CVE-2026-15704
In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's middleware.StripSlashes,...
CVE-2026-15704
In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's middleware.StripSlashes,...
EUVD-2026-43647
Eclipse Jetty: Path parameter traversal...
EUVD-2026-43645
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections...
Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
Summary The DigestAuthentication.apply method in Jetty's HTTP client uses getBytesStandardCharsets.ISO88591 at three locations lines 171, 179, 196 to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF Chinese, Japanese, Cyrillic, Arabic, Emoji, etc. with...
SUSE CVE-2026-16439
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...
SUSE CVE-2026-16441
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...
Vulnerabilities found in Oracle Financial Services
Oracle has identified vulnerabilities in various Financial Services modules. Oracle has also processed updates for various third-party products. The vulnerabilities include code injection through malicious schemes in Apache Avro, unauthorized access to sensitive data in various Oracle products, a...
Vulnerabilities found in Oracle Communications
Oracle has identified vulnerabilities in its Communications products and underlying third-party software. There are a total of 213 vulnerabilities, of which 67 reside in Oracle products and 146 in third-party products that have already received updates. The most serious vulnerabilities, 12 in...
CVE-2026-16243
In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero...
CVE-2026-16441 Eclipse OpenJ9 : Method resolution default method precedence failure
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...
CVE-2026-16441 Eclipse OpenJ9 : Method resolution default method precedence failure
In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...
CVE-2026-16243 Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero
In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero...
EUVD-2026-46347
In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero...
CVE-2026-16243
CVE-2026-16243 affects the Eclipse OMR OMR project: the arraycmp SIMD implementation for Z and P architectures does not validate the bytes-to-compare when the count is zero. This can allow a remote attacker with low privileges and user interaction to trigger a denial-of-service, rendering the sys...
CVE-2026-16439
CVE-2026-16439 affects Eclipse OpenJ9 up to version 0.60. The issue arises when using -Xtrace to trace method arguments, which can cause a buffer underflow. The NVD metrics show a CRITICAL base score (CVSS 3.1: 9.1) with no confidentiality impact but high integrity and availability impact; attack...