Access Control

Every one of the 43 is a mark on the map. Named now: 1 to 26, most at risk first.

1. The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other s…CVE-2016-4800Eclipse · 6.5% likely

   CWE-284

2. From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.CVE-2019-17631The Eclipse Foundation · 2.1% likely

   CWE-285

3. In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.CVE-2021-41035The Eclipse Foundation · 1.8% likely

   CWE-250

4. Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the default listener specifie…CVE-2018-20145Eclipse · 1.6% likely

   CWE-732

5. In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked when a durable client…CVE-2021-34434The Eclipse Foundation · 1.3% likely

   CWE-285

6. The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed on…CVE-2020-27220The Eclipse Foundation · 1.2% likely

   CWE-862

7. In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked…CVE-2019-11777The Eclipse Foundation · 0.8% likely

   CWE-346

8. In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will s…CVE-2018-12546The Eclipse Foundation · 0.8% likely

   CWE-284

9. In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().CVE-2021-41038The Eclipse Foundation · 0.7% likely

   CWE-940

10. Improper Authorization in /user/namespace/{namespace}/detailsCVE-2025-1007Eclipse Foundation · CVSS 6.9 · 0.5% likely

    CWE-283

11. OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed defaultCVE-2026-18918Eclipse Foundation · CVSS 9.1 · 0.5% likely

    CWE-863

12. In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach…CVE-2018-12539The Eclipse Foundation · 0.5% likely

    CWE-419

13. In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling reque…CVE-2026-80515Eclipse Foundation · CVSS 8.9 · 0.5% likely

    CWE-647

14. CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go ComponentsCVE-2026-15704Eclipse Foundation · CVSS 9.8 · 0.5% likely

    CWE-863

15. Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tamperingCVE-2026-89293Eclipse Foundation · CVSS 8.8 · 0.5% likely

    CWE-862

16. In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annota…CVE-2026-18661Eclipse Foundation · CVSS 8.8 · 0.4% likely

    CWE-863

17. In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous…CVE-2026-62927Eclipse Foundation · CVSS 8.7 · 0.4% likely

    CWE-863

18. Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substringCVE-2026-18659Eclipse Foundation · CVSS 6.9 · 0.4% likely

    CWE-863

19. AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.CVE-2019-11771The Eclipse Foundation · 0.4% likely

    CWE-264

20. In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patter…CVE-2026-18662Eclipse Foundation · CVSS 6.9 · 0.4% likely

    CWE-863

21. In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the ru…CVE-2026-58080Eclipse Foundation · CVSS 8.8 · 0.4% likely

    CWE-862

22. EDC DataSetResolver policy filtering missingCVE-2024-9202Eclipse Foundation · CVSS 5.3 · 0.4% likely

    CWE-862

23. Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users.CVE-2019-11773The Eclipse Foundation · 0.4% likely

    CWE-264

24. Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware ExfiltrationCVE-2026-16454Eclipse Foundation · CVSS 4.3 · 0.4% likely

    CWE-862

25. In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt J…CVE-2026-8384Eclipse Foundation · CVSS 5.3 · 0.3% likely

    CWE-647

26. In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the ca…CVE-2026-127102Eclipse Foundation · CVSS 7.1 · 0.3% likely

    CWE-863

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.