Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Eclipse Theia 1.73.0 Clear all filters
TI-2026-08812 CVE-2026-10055

Information disclosure in Eclipse Theia

Priority LOW 37

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00399 Published 2026-07-03 Fixed in 1.73.0 CWE-200
TI-2026-08811 CVE-2026-10054

Missing authentication in Eclipse Theia

Priority LOW 39

In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00219 Published 2026-07-03 Fixed in 1.73.0 CWE-1385