CVE-2026-67222

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied listtoatom/1 to every colon-delimited token in an attacker-controlled authmechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a larg...

UBUNTU-CVE-2026-67222

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied listtoatom/1 to every colon-delimited token in an attacker-controlled authmechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a larg...

UBUNTU-CVE-2026-67225

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tune handshake but did not compare it with an inbound frame's declared length before buffering the frame. With the stream plugin...

CVE-2026-67227

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter :name. resourceexists/2 and the PUT/DELETE handlers call rabbitdatacoercion:toatom/1 on the :name URL path segment. toatom/1 uses binarytoatom/2 unsafe...

CVE-2026-67225

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tune handshake but did not compare it with an inbound frame's declared length before buffering the frame. With the stream plugin...

EUVD-2026-87143

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied listtoatom/1 to every colon-delimited token in an attacker-controlled authmechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a larg...

CVE-2026-67222

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied listtoatom/1 to every colon-delimited token in an attacker-controlled authmechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a larg...

CVE-2026-67222

The messaging and streaming broker RabbitMQ is vulnerable to a Denial of Service (DoS) attack in versions 3.13.0 through 3.13.14 , 4.0.0 through 4.0.19 , 4.1.0 through 4.1.10 , and 4.2.0 through 4.2.5 . The root cause is that the mechanisms/1 function applies list_to_atom/1 to every colon-delimit...

CVE-2026-67222 RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied listtoatom/1 to every colon-delimited token in an attacker-controlled authmechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a larg...

CVE-2026-67222 RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied listtoatom/1 to every colon-delimited token in an attacker-controlled authmechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a larg...

Exploit for OS Command Injection in Plainview_Activity_Monitor_Project Plainview_Activity_Monitor

wp-plainview-auth-RCE-broken-cookie-to-session-fix WP Plain...

BIT-GRAFANA-2026-15815 CVE-2026-15815 CVE Record

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory...

CVE-2026-15667

CVE-2026-15667 CVE-2026-15667 WordPress Event Solution LFI POC Eventin plugin de WordPress wp-event-solution ≤ 4.1.22 — inclusión de archivos locales autenticada Contributor+ a través del campo REST eventlayout. Solo para pruebas autorizadas. No ejecutes esto contra sistemas que no sean de tu...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin BP Better Messages versions = 3.0.4...

CVE-2026-80514

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

CVE-2026-88848

The MasterStudy LMS WordPress plugin (versions 1.9 to

CVE-2026-88848 MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid...

WordPress Bookly plugin < 28.3 - Unauthenticated Customer PII Update vulnerability

Unauthenticated Customer PII Update vulnerability discovered by Artus KG in WordPress Plugin Bookly versions 28.3...

Exploit for CVE-2026-14281

CVE-2026-14281 — WAWP Automation Web Platform Unauthenticate...

CVE-2026-96766

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...