Advisories · Technology

Eclipse Foundation Eclipse CSI - PIA.

Every CVE that names Eclipse Foundation Eclipse CSI - PIA among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-107597 CVE record

CVSS 5.1 Medium

jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme
- Eclipse Foundation Eclipse CSI - PIA
- Server-side request forgery (SSRF)
Not analysed yet 20 Oct 2026
CVE-2026-108062 CVE record

CVSS 6.9 Medium

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop
- Eclipse Foundation Eclipse CSI - PIA
- Denial of service
Not analysed yet 20 Oct 2026
CVE-2026-18353 CVE record

CVSS 8.8 High

Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass
- Eclipse Foundation Eclipse CSI - PIA
- Server-side request forgery (SSRF)
Not analysed yet 30 Jul 2026
CVE-2026-14336 CVE record

CVSS 8.2 High

Server-side request forgery in Eclipse Foundation Eclipse CSI - PIA
- Eclipse Foundation Eclipse CSI - PIA
- Server-side request forgery (SSRF)
Not analysed yet 2 Jul 2026
CVE-2026-12616 CVE record

CVSS 6.9 Medium

Log injection in Eclipse Foundation Eclipse CSI - PIA
- Eclipse Foundation Eclipse CSI - PIA
- Other injection
Not analysed yet 29 Jun 2026