| CVE-2026-82217 |
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools…
|
8.8
Élevée
|
31 août 2026 |
| CVE-2026-19884 |
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without…
|
8.4
Élevée
|
14 août 2026 |
| CVE-2026-61891 |
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download…
|
7.5
Élevée
|
5 août 2026 |
| CVE-2026-60009 |
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every…
|
8.8
Élevée
|
5 août 2026 |
| CVE-2026-12609 |
In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the…
|
7.5
Élevée
|
5 août 2026 |
| CVE-2026-14574 |
In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core`…
|
5.7
Moyenne
|
5 août 2026 |
| CVE-2026-10055 |
In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from…
|
8.5
Élevée
|
3 juil. 2026 |
| CVE-2026-10054 |
In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over…
|
8.8
Élevée
|
3 juil. 2026 |
| CVE-2026-44691 |
In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g
|
8.4
Élevée
|
18 juin 2026 |
| CVE-2026-22551 |
In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP…
|
6.7
Moyenne
|
18 juin 2026 |
| CVE-2026-46580 |
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were…
|
8.4
Élevée
|
18 juin 2026 |
| CVE-2026-44688 |
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its…
|
8.4
Élevée
|
18 juin 2026 |