How many CVEs does Eclipse Foundation have?

Eclipse Foundation has 322 published CVE records since 2006, including 120 in the last two years.

How many Eclipse Foundation CVEs are in CISA KEV?

Yes — 1 of Eclipse Foundation's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Eclipse Foundation products have the most CVEs?

The Eclipse Foundation products with the most published CVEs are Jetty, Eclipse Jetty, jetty.project, mosquitto, OpenJ9.

What are the most common weakness types in Eclipse Foundation CVEs?

Eclipse Foundation's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-20 (Improper Input Validation), CWE-400 (Uncontrolled Resource Consumption), CWE-125 (Out-of-bounds Read).

How many critical Eclipse Foundation vulnerabilities are there?

Eclipse Foundation has 60 critical and 127 high-severity CVEs.

What is the average severity of Eclipse Foundation CVEs?

The average CVSS base score across Eclipse Foundation's scored CVEs is 7.3.

Eclipse Foundation Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Eclipse Foundation vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

Eclipse Foundation has 322 published CVE records since 2006, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 38 have a known public exploit. The average CVSS base score across scored CVEs is 7.3.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Eclipse Foundation products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Eclipse Foundation's vulnerability posture, as a share of its 322 published CVEs.

Average CVSS: 7.3
Critical / high: 58%
Actively exploited (KEV): 0%
Public exploit available: 12%
Patch available: 93%

Severity and exploitation

How the CVSS severity of Eclipse Foundation's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical60

High127

Medium123

Low12

In CISA’s Known Exploited Vulnerabilities catalog

One of Eclipse Foundation's CVEs is confirmed exploited in the wild.

Public exploits

38 of Eclipse Foundation's CVEs have a known public exploit available.

Most affected products

The Eclipse Foundation products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Eclipse Foundation CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Eclipse Foundation CVE records.

Disclosure activity by year

How many Eclipse Foundation CVEs were published each year.

2019

2020

2021

2022

2023

2024

2025

Latest Eclipse Foundation CVEs

The most recently disclosed vulnerabilities affecting Eclipse Foundation.

High vulnerability · 2026-08-31
CWE-22
High · CVSS 8.8
EPSS 0.4%2026-08-31
OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default
CWE-863
Critical · CVSS 9.1
EPSS 0.4%2026-08-28
Medium vulnerability · 2026-08-27
CWE-22
Medium · CVSS 6.0
EPSS 0.4%2026-08-27
Medium vulnerability · 2026-08-19

Other vendors

Browse vulnerabilities for other tracked vendors.

Cybozu, Inc332 CVEs Progress330 CVEs Elastic330 CVEs Opera326 CVEs Moxa320 CVEs OpenSSL319 CVEs Open-Xchange318 CVEs discourse313 CVEs

Browse all vendors

Frequently asked questions

Common questions about Eclipse Foundation vulnerabilities.

How many CVEs does Eclipse Foundation have?: Eclipse Foundation has 322 published CVE records since 2006, including 120 in the last two years.
How many Eclipse Foundation CVEs are in CISA KEV?: Yes — 1 of Eclipse Foundation's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Eclipse Foundation products have the most CVEs?: The Eclipse Foundation products with the most published CVEs are Jetty, Eclipse Jetty, jetty.project, mosquitto, OpenJ9.
What are the most common weakness types in Eclipse Foundation CVEs?: Eclipse Foundation's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-20 (Improper Input Validation), CWE-400 (Uncontrolled Resource Consumption), CWE-125 (Out-of-bounds Read).
Are there public exploits for Eclipse Foundation vulnerabilities?: Yes — 38 of Eclipse Foundation's CVEs have a known public exploit.
How many critical Eclipse Foundation vulnerabilities are there?: Eclipse Foundation has 60 critical and 127 high-severity CVEs.
What is the average severity of Eclipse Foundation CVEs?: The average CVSS base score across Eclipse Foundation's scored CVEs is 7.3.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Eclipse Foundation vulnerabilities

Monitor new Eclipse Foundation vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing