Input Validation and Logic

Every one of the 36 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Eclipse BIRT Viewer - Remote Code ExecutionCVE-2021-34427The Eclipse Foundation · 58% likely

   CWE-20

2. In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the func…CVE-2018-12547The Eclipse Foundation · 2.7% likely

   CWE-20

3. In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters,…CVE-2019-11779The Eclipse Foundation · 2.7% likely

   CWE-754

4. In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.…CVE-2019-10245The Eclipse Foundation · 2.5% likely

   CWE-20

5. In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.CVE-2021-28170The Eclipse Foundation · 2.1% likely

   CWE-20

6. Eclipse CycloneDDS Improper Handling of Syntactically Invalid StructureCVE-2021-38443Eclipse · CVSS 6.6 · 2.1% likely

   CWE-228

7. When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid.…CVE-2018-12551The Eclipse Foundation · 1.5% likely

   CWE-703

8. The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strin…CVE-2017-7653The Eclipse Foundation · 1.4% likely

   CWE-20

9. When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will…CVE-2018-12550The Eclipse Foundation · 1.4% likely

   CWE-440

10. In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI…CVE-2022-2047The Eclipse Foundation · CVSS 2.7 · 1.3% likely

    CWE-20

11. In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that a…CVE-2020-27217The Eclipse Foundation · 1.3% likely

    CWE-1284

12. In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.CVE-2021-34432The Eclipse Foundation · 1.2% likely

    CWE-20

13. In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation,…CVE-2021-41041The Eclipse Foundation · 1.1% likely

    CWE-252

14. Jetty URI parsing of invalid authorityCVE-2024-6763Eclipse Foundation · CVSS 3.7 · 1.0% likely

    CWE-1286

15. In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g.…CVE-2023-0100The Eclipse Foundation · 0.8% likely

    CWE-20

16. Glassfish redirect to untrusted siteCVE-2024-9329Eclipse Foundation · CVSS 6.9 · 0.7% likely

    CWE-233

17. In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation…CVE-2026-61387Eclipse Foundation · CVSS 6.9 · 0.6% likely

    CWE-460

18. Eclipse OpenJ9 : Method resolution default method precedence failureCVE-2026-16441Eclipse Foundation · CVSS 6.9 · 0.5% likely

    CWE-758

19. In NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an out-of-bound read by a crafted SNMPv3 security parameters.CVE-2025-55087Eclipse Foundation · CVSS 6.3 · 0.5% likely

    CWE-1285

20. In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the server DUID from the…CVE-2025-55086Eclipse Foundation · CVSS 6.3 · 0.4% likely

    CWE-1285

21. Databroker 0.6.1 PublishValue missing data_point panicCVE-2026-13699Eclipse Foundation · CVSS 4.3 · 0.4% likely

    CWE-20

22. NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is fullCVE-2026-114408Eclipse Foundation · CVSS 8.7 · 0.4% likely

    CWE-252

23. In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 (available since 5.1.0, org.eclipse.kura.res…CVE-2026-113422Eclipse Foundation · CVSS 7.7 · 0.4% likely

    CWE-807

24. JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nilCVE-2026-89313Eclipse Foundation · CVSS 6.3 · 0.3% likely

    CWE-706

25. In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the b…CVE-2026-112186Eclipse Foundation · CVSS 8.7 · 0.3% likely

    CWE-696

26. NULL pointer dereference in the BSD raw IPv6 send path when the destination table is fullCVE-2026-115403Eclipse Foundation · CVSS 8.2 · 0.3% likely

    CWE-252

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.