EUVD-2026-43645

Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections...

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Summary The DigestAuthentication.apply method in Jetty's HTTP client uses getBytesStandardCharsets.ISO88591 at three locations lines 171, 179, 196 to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF Chinese, Japanese, Cyrillic, Arabic, Emoji, etc. with...

SUSE CVE-2026-16439

In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...

SUSE CVE-2026-16441

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...

Vulnerabilities found in Oracle Financial Services

Oracle has identified vulnerabilities in various Financial Services modules. Oracle has also processed updates for various third-party products. The vulnerabilities include code injection through malicious schemes in Apache Avro, unauthorized access to sensitive data in various Oracle products, a...

Vulnerabilities found in Oracle Communications

Oracle has identified vulnerabilities in its Communications products and underlying third-party software. There are a total of 213 vulnerabilities, of which 67 reside in Oracle products and 146 in third-party products that have already received updates. The most serious vulnerabilities, 12 in...

CVE-2026-16243

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero...

CVE-2026-16441 Eclipse OpenJ9 : Method resolution default method precedence failure

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...

CVE-2026-16441 Eclipse OpenJ9 : Method resolution default method precedence failure

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...

EUVD-2026-46347

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero...

CVE-2026-16243 Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero...

CVE-2026-16243

The CVE-2026-16243 entry concerns Eclipse OMR up to version 0.11, where the arraycmp SIMD implementation for Z and P does not check whether the number of bytes to compare is zero. The connected sources (NVD and CVE records) confirm the affected component and the root cause, but do not provide det...

CVE-2026-16439

CVE-2026-16439 affects Eclipse OpenJ9 up to version 0.60. The issue arises when using the -Xtrace option to trace method arguments, which can cause a buffer underflow. The CVSS v4.0 base score is 5.8 (MEDIUM); impact includes potential losses in integrity and availability, with low privileges req...

EUVD-2026-46338

In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...

CVE-2026-16439 Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow

In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...

CVE-2026-16454

CVE-2026-16454 affects Eclipse hawkBit (DDI Controller)

CVE-2026-16454 Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability CWE-284 / CWE-862 has been identified in the Direct Device Integration DDI Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned...

Linux Distros Unpatched Vulnerability : CVE-2026-12606

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP...

DEBIAN-CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...

CVE-2026-57898

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...