Eclipse Hawkbit vulnerabilities

3 CVEs affecting Eclipse Hawkbit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-16454, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-27219, published 2021-01-14. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST…
CVE-2019-10240, published 2019-04-03. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised…
CVE-2026-16454, published 2026-07-21. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller. This vulnerability…