CVE-2026-108062Medium· 6.9▾ SunlitPre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 38 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.
eclipse_csi_-_pia <= 0.8.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113619High· 7.5Eclipse ioFog renders request templates before authentication
CVE-2026-107597Medium· 5.1jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme
CVE-2026-102462High· 8.2In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer…
CVE-2026-12611High· 8.7A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race conditio…
CVE-2026-91041High· 7.8FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image
CVE-2026-96582Medium· 4.9Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser