SecAlerts
E

Eclipse Foundation

Security Risk Profile

52
/100
medium

Security Risk Score

Comprehensive risk assessment based on 84 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from October 5, 2009 to present

84
Total CVEs
14
Critical+High
1
Exploited
11
Unpatched

Threat Assessment

Avg CVSS
6.5
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
11
Critical/High
Risk Level
52/100
medium
⚠️ 1 Active Exploits🆕 2Fresh (<7d)📈 12 in Last 30 Days

Severity Distribution

Critical
2
High
12
Medium
18
Low
5

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
0

Age Distribution

Common Weaknesses (CWE)

1
Integer Overflow
1
2
SSRF
1
3
Infoleak
1
4
CSRF
1
5
XSS
1

Most Affected Products

1. Eclipse Foundation Temurin24
2. Eclipse Foundation Jetty23
3. Eclipse threadx NetX Duo11
4. Eclipse Foundation ThreadX7
5. Eclipse Foundation USBX7

Recent Vulnerabilities

See more →
GHSA-c38r-v552-gh5g
CVSS 7.0high

Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode

Nov 2, 2026🔧 No Patch
GHSA-67ww-q8x2-g487
CVSS 6.8medium

Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation

Nov 2, 2026🔧 No Patch
CVE-2026-94024
CVSS 6.9medium

Module Manager object lookup validates one byte of a module's search name

Oct 20, 2026🔧 No Patch
CVE-2026-92843
CVSS 8.7high

Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure

Oct 20, 2026🔧 No Patch
CVE-2026-91189
CVSS 7.1high

GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme

Oct 20, 2026🔧 No Patch
CVE-2026-91186
CVSS 8.4high

PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write

Oct 20, 2026🔧 No Patch
CVE-2026-95111
CVSS 4.8medium

Module queue front-send validates a word count as a byte count

Oct 20, 2026🔧 No Patch
CVE-2026-96406
CVSS 4.9medium

VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound

Oct 20, 2026🔧 No Patch
CVE-2026-96582
CVSS 4.9medium

Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser

Oct 20, 2026🔧 No Patch
CVE-2026-107597
CVSS 5.1medium

jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme

Oct 20, 2026🔧 No Patch

Monitor Eclipse Foundation in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.