Eclipse Foundation

The Eclipse Foundation maintains a broadly represented portfolio spanning web servers, embedded messaging, virtual machines, and real-time operating-system components, creating a diverse attack surface across both cloud infrastructure and embedded deployments. Vulnerabilities affecting the vendor skew toward serious outcomes, with a meaningful share reaching critical severity, though public exploit availability and confirmed in-the-wild exploitation remain limited relative to the disclosure volume. The exposure recurs across flagship products such as Jetty, Mosquitto, OpenJ9, ThreadX NetX Duo, and ThreadX USBX through weakness classes including out-of-bounds reads, cross-site scripting, improper input validation, and uncontrolled resource consumption, reflecting the memory-safety and input-handling demands of network-exposed and embedded software. Defenders should prioritize vulnerability monitoring for Foundation projects embedded in production infrastructure, particularly where internet-facing or resource-constrained deployments are involved; current exploitation activity and exposure counts are shown alongside this summary.