Cross-site Scripting

Every one of the 22 is a mark on the map. Named now: 1 to 22, most at risk first.

1. In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL aga…CVE-2019-10241The Eclipse Foundation · 9.4% likely

   CWE-79

2. Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE before 3.6.2 allow remote attackers to inject arbitra…CVE-2010-4647Eclipse · 5.7% likely

   CWE-79

3. Cross-site scripting (XSS) vulnerability in birt-viewer/run in Eclipse Business Intelligence and Reporting Tools (BIRT) before 2.5.0, as used in KonaKart and other products, allow…CVE-2009-4521Eclipse · 3.5% likely

   CWE-79

4. In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.CVE-2020-27224The Eclipse Foundation · 2.6% likely

   CWE-79

5. faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS be…CVE-2019-17091Eclipse · 2.5% likely

   CWE-79

6. Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must…CVE-2019-17634The Eclipse Foundation · 1.9% likely

   CWE-79

7. In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-…CVE-2019-17632The Eclipse Foundation · 1.9% likely

   CWE-79

8. Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE, possibly 3.3.2, allow remote attackers to inject arb…CVE-2008-7271Eclipse · 1.9% likely

   CWE-79

9. JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.CVE-2009-5046Eclipse · 1.5% likely

   CWE-79

10. In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context.CVE-2019-11776The Eclipse Foundation · 0.9% likely

    CWE-79

11. In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. S…CVE-2020-27219The Eclipse Foundation · 0.8% likely

    CWE-79

12. In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.CVE-2021-28161The Eclipse Foundation · 0.7% likely

    CWE-79

13. Eclipse Ditto User Interface vulnerable to XSS due to Improper Neutralization of InputCVE-2024-5165Eclipse Foundation · CVSS 6.5 · 0.5% likely

    CWE-79

14. In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Dispos…CVE-2026-13323Eclipse Foundation · CVSS 4.1 · 0.3% likely

    CWE-79

15. Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security headers such as Conte…CVE-2026-4983Eclipse Foundation · CVSS 4.1 · 0.3% likely

    CWE-79

16. In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escapi…CVE-2025-11966Eclipse Foundation · CVSS 2.3 · 0.3% likely

    CWE-80

17. In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.CVE-2024-9343Eclipse Foundation · CVSS 6.1 · 0.3% likely

    CWE-79

18. In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.CVE-2024-10032Eclipse Foundation · CVSS 6.1 · 0.2% likely

    CWE-79

19. In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.CVE-2024-10029Eclipse Foundation · CVSS 4.5 · 0.2% likely

    CWE-79

20. Reflected XSS via client window id in URL client window modeCVE-2026-120421Eclipse Foundation · CVSS 6.1 · 0.2% likely

    CWE-79

21. In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system.CVE-2024-10031Eclipse Foundation · CVSS 5.8 · 0.2% likely

    CWE-79

22. In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `add…CVE-2026-118492Eclipse Foundation · CVSS 2 · 0.1% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.