Advisories · Technology

Eclipse Foundation Eclipse ioFog.

Every CVE that names Eclipse Foundation Eclipse ioFog among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-113644 CVE record

CVSS 5.5 Medium

iofogctl command injection via Controller provisioning response
- Eclipse Foundation Eclipse ioFog
- Command injection
Not analysed yet 27 Oct 2026
CVE-2026-115216 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials
- Eclipse Foundation Eclipse ioFog
- Weak cryptography or TLS
Not analysed yet 27 Oct 2026
CVE-2026-113620 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Eclipse ioFog operator WebSocket accepts an unverified JWT
- Eclipse Foundation Eclipse ioFog
- Weak cryptography or TLS
Not analysed yet 20 Oct 2026
CVE-2026-113619 CVE record

CVSS 7.5 High

Eclipse ioFog renders request templates before authentication
- Eclipse Foundation Eclipse ioFog
- Denial of service
Not analysed yet 20 Oct 2026