Eclipse Mojarra - Local File Read

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter. id: CVE-2020-6950 info: name: Eclipse Mojarra - Local File Read author: iamnoooob,pdresearch severity: medium description: | Directory traversal in Eclipse Mojarra...

Eclipse BIRT Viewer - Remote Code Execution

Eclipse BIRT versions 4.8.0 and earlier contain a JSP injection caused by query parameters, letting remote attackers create and access malicious JSP files in the viewer directory, exploit requires sending crafted query parameters. id: CVE-2021-34427 info: name: Eclipse BIRT Viewer - Remote Code...

Eclipse Jetty - Information Disclosure

Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224 is susceptible to improper authorization. The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can access sensitive information regarding...

Eclipse Jetty ConcatServlet - Information Disclosure

Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information,...

CVE-2026-16440

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

CVE-2026-16440

Eclipse OpenJ9 versions up to 0.60 are vulnerable to a segmentation fault triggered by a crafted .class file containing deeply nested annotations. The root cause is improper handling of annotation nesting depth during class file processing, leading to a crash and denial of service . The CVSS 4.0 ...

CVE-2026-16440

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

EUVD-2026-62368

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

CVE-2026-16440

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

CVE-2024-7708

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause a denial of service DoS by sending specially crafted HTTP requests. Specifically, a buffer leak occurs when processing requests that have a body but read zero bytes, such as 100-Continue requests, or during sl...

Linux Distros Unpatched Vulnerability : CVE-2026-15803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query...

CVE-2026-75058

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers...

EUVD-2026-60257

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers...

CVE-2026-75058

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers...

CVE-2026-75058

XML External Entity (XXE) injection in IntelliJ IDEA's Eclipse settings importers affects versions before 2026.2.1. CVSS 5.5 (MEDIUM) — local attack, no privileges, high confidentiality impact. Remediation: upgrade to IntelliJ IDEA 2026.2.1 or later. No in-the-wild exploitation reported. Details:...

CVE-2026-75058

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers...

PT-2026-76707

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers...

Eclipse Jetty - Information Disclosure

Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 are susceptible to improper authorization. URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. An attacker can potentially obtain sensitive informatio...

Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2026-10051, CVE-2026-6790, CVE-2026-8384, CVE-2026-10050, CVE-2026-59879, CVE-2026-59880)

Summary IBM Rational Developer for i is affected by a sensitive information exposure vulnerability in Eclipse Jetty-server CVE-2026-10051, an improper input validation vulnerability in Eclipse Jetty-server CVE-2026-6790, an authorization decision vulnerability in Eclipse Jetty-util CVE-2026-8384,...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...