CVE-2026-93649Published

In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query pa…

Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-93649

Published

Adoptium Temurin

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Eclipse Foundation",
                    "product": "Adoptium Temurin",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "1f9753c",
                            "versionType": "git"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON