Product by Eclipse Foundation
Eclipse Theia
15 known vulnerabilities in Eclipse Theia (Eclipse Foundation), 0 of them actively exploited (CISA KEV).
Key figures
15
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-12609 | Eclipse Theia: Path Traversal | 7.5 | |
| Critical | CVE-2020-27224 | The Eclipse Foundation Eclipse Theia: Cross-site Scripting | 9.6 | |
| Critical | CVE-2021-34436 | The Eclipse Foundation Eclipse Theia: Improper Restriction of XML External Entity Reference | 9.8 | |
| High | CVE-2026-60009 | Eclipse Theia: Path Traversal | 8.8 | |
| High | CVE-2026-46580 | Eclipse Theia: Inclusion of Functionality from Untrusted Control Sphere | 8.8 | |
| High | CVE-2026-44688 | Eclipse Theia: Inclusion of Functionality from Untrusted Control Sphere | 8.8 | |
| High | CVE-2026-61891 | Eclipse Theia: Path Traversal | 7.5 | |
| High | CVE-2026-44691 | Eclipse Theia: Inclusion of Functionality from Untrusted Control Sphere | 8.8 | |
| Medium | CVE-2026-14574 | Eclipse Theia: Prototype Pollution | 6.5 | |
| High | CVE-2021-34435 | The Eclipse Foundation Eclipse Theia: Permissive Cross-domain Security Policy with Untrusted Domains | 8.8 | |
| High | CVE-2019-17636 | The Eclipse Foundation Eclipse Theia: Insufficient Verification of Data Authenticity | 8.1 | |
| Medium | CVE-2026-22551 | Eclipse Theia: Insertion of Sensitive Information Into Sent Data | 6.5 | |
| Medium | CVE-2021-28162 | The Eclipse Foundation Eclipse Theia: Inclusion of Web Functionality from an Untrusted Source | 6.1 | |
| Medium | CVE-2021-41038 | The Eclipse Foundation @theia/plugin-ext: Improper Verification of Source of a Communication Channel | 6.1 | |
| Medium | CVE-2021-28161 | The Eclipse Foundation Eclipse Theia: Cross-site Scripting | 6.1 |