CVE-2026-84197Critical 9.2In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-cl0.3%
CVE-2026-82958High 7.6In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }0.4%
CVE-2026-84175Medium 5.3In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without va0.4%
CVE-2024-5165Medium 6.5Eclipse Ditto User Interface vulnerable to XSS due to Improper Neutralization of Input0.5%