Eclipse Foundation Eclipse GlassFish

• CVE-2026-12605 Critical 9.6 In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin 0.4%
• CVE-2026-12606 Medium 6.3 Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports 0.3%
• CVE-2026-2586 Critical 9.1 An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of a 0.8%
• CVE-2026-2587 Critical 9.6 A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evalu 0.6%
• CVE-2026-24457 Critical 9.1 An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorize 0.7%
• CVE-2024-9408 High 8.9 In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints. 0.3%
• CVE-2024-10032 Medium 6.1 In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console. 0.2%
• CVE-2024-10031 Medium 5.8 In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system. 0.2%
• CVE-2024-10029 Medium 4.5 In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console. 0.2%
• CVE-2024-9343 Medium 6.1 In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console. 0.3%
• CVE-2024-9342 Medium 6.3 In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack p 0.5%
• CVE-2024-8646 Medium 6.1 Eclipse Glassfish: URL redirection vulnerability to untrusted sites 0.4%