Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-89292

Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures

In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Eclipse Mnestix
CVE-2026-89295

Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter

In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Eclipse Mnestix
CVE-2026-89293

Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering

In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Eclipse Mnestix