Information Disclosure

Every one of the 27 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Eclipse Jetty - Information DisclosureCVE-2021-34429The Eclipse Foundation · CVSS 5.3 · 99% likely

   CWE-200

2. Eclipse Jetty - Information DisclosureCVE-2021-28164The Eclipse Foundation · CVSS 5.3 · 82% likely

   CWE-200

3. Eclipse Jetty ConcatServlet - Information DisclosureCVE-2021-28169The Eclipse Foundation · CVSS 5.3 · 78% likely

   CWE-200

4. Eclipse Jetty <9.2.9.v20150224 - Sensitive Information LeakageCVE-2015-2080Eclipse · 75% likely

   CWE-200

5. Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before reje…CVE-2017-9735Eclipse · 9.6% likely

   CWE-203

6. In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests fr…CVE-2020-27218The Eclipse Foundation · 8.3% likely

   CWE-226

7. In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured…CVE-2019-10247The Eclipse Foundation · 5.9% likely

   CWE-213

8. In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and…CVE-2018-12536The Eclipse Foundation · 4.2% likely

   CWE-209

9. In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory…CVE-2021-28163The Eclipse Foundation · CVSS 2.7 · 4.2% likely

   CWE-200

10. In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a re…CVE-2019-10246The Eclipse Foundation · 4.1% likely

    CWE-213

11. Dump Servlet information leak in jetty before 6.1.22.CVE-2009-5045Eclipse · 2.3% likely

    CWE-200

12. In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used as a hint by an attacker to specifically craft attacks to…CVE-2019-10243The Eclipse Foundation · 1.3% likely

    CWE-497

13. Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse JettyCVE-2023-26049eclipse · CVSS 2.4 · 1.3% likely

    CWE-200

14. In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allow…CVE-2026-60007Eclipse Foundation · CVSS 9.1 · 0.6% likely

    CWE-204

15. In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included insecure default configu…CVE-2026-86464Eclipse Foundation · CVSS 9.9 · 0.5% likely

    CWE-200

16. In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are condition…CVE-2026-5795Eclipse Foundation · CVSS 7.4 · 0.5% likely

    CWE-226

17. When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the…CVE-2026-77711Eclipse Foundation · CVSS 8.2 · 0.4% likely

    CWE-200

18. In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request tha…CVE-2026-10051Eclipse Foundation · CVSS 6.9 · 0.4% likely

    CWE-200

19. Eclipse EDC: OAuth2 Credential Exfiltration VulnerabilityCVE-2024-4536Eclipse Foundation · CVSS 6.8 · 0.4% likely

    CWE-201

20. In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication cr…CVE-2026-76184Eclipse Foundation · CVSS 8.2 · 0.4% likely

    CWE-200

21. In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.CVE-2017-9868Eclipse · 0.4% likely

    CWE-200

22. CachingWebClient shares user-specific HTTP responses across users via the shared cache tierCVE-2026-118489Eclipse Foundation · CVSS 7.5 · 0.3% likely

    CWE-200

23. In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Com…CVE-2026-22551Eclipse Foundation · CVSS 6.7 · 0.3% likely

    CWE-201

24. In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgo…CVE-2026-101322Eclipse Foundation · CVSS 8.3 · 0.3% likely

    CWE-201

25. A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run under a privileged us…CVE-2022-0672Eclipse · 0.3% likely

    CWE-200

26. In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-or…CVE-2026-15075Eclipse Foundation · CVSS 8.2 · 0.2% likely

    CWE-200

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.