CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 4:30 AM ET)

What this means for you

This week: 3,085 CVEs published, 231 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,085; Show in the list
Critical, last 7 days: 231; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product eclipse_foundation:eclipse_jetty. Show all products

15 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-77711	High 8.2	When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). Assigned by eclipse	Oct 15, 2026
CVE-2026-76184	High 8.2	In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/… Assigned by eclipse	Oct 15, 2026
CVE-2026-76182	Medium 6.9	In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. Assigned by eclipse	Oct 15, 2026
CVE-2026-12611	High 8.7	A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. Assigned by eclipse	Sep 8, 2026
CVE-2026-19203	High 8.3	A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP re… Assigned by eclipse	Sep 8, 2026
CVE-2026-19204	High 8.7	A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. Assigned by eclipse	Sep 7, 2026
CVE-2026-10050	High 8.7	Digest authentication lossy encoding Assigned by eclipse	Aug 4, 2026
CVE-2024-7708	High 7.5	For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. Assigned by eclipse	Jul 14, 2026
CVE-2026-8384	Medium 5.3	In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not a… Assigned by eclipse	Jul 14, 2026
CVE-2026-6790	Medium 5.3	In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). Assigned by eclipse	Jul 14, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.