en
The Eclipse Foundation is an international nonprofit organization that provides vendor-neutral governance and infrastructure for the Eclipse ecosystem, hosting 450+ open source projects and a global community of contributors and members. It acts as steward for Eclipse tooling, runtimes, IDEs, and industry collaborations.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/22/2026, Eclipse Foundation recorded 141 security vulnerabilities in the last 90 days across 56 products, including 93 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, NetX Duo had the most security vulnerabilities in the Eclipse Foundation ecosystem, with 21 vulnerabilities—approximately 14.89% of the provider's total vulnerabilities during this period.
CVE-2026-89320HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrityCVE-2026-89319JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocationCVE-2026-89318JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)CVE-2026-89317JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)CVE-2026-89316LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion270 Results | Page 1 of 27
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityHigh |