Eclipse Foundation org.eclipse.jetty:jetty-security

• CVE-2026-18659 Medium 6.9 Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring 0.4%
• CVE-2026-18662 Medium 6.9 In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined 0.4%
• CVE-2026-19864 Medium 5.6 Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a s <0.1%