ROOT-APP-MAVEN-CVE-2026-34197 CVE-2026-34197 in org.apache.activemq:activemq-broker - Patched by Root

Root has patched CVE-2026-34197 in the org.apache.activemq:activemq-broker package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-42588 CVE-2026-42588 in org.apache.activemq:activemq-broker - Patched by Root

Root has patched CVE-2026-42588 in the org.apache.activemq:activemq-broker package for Root:Maven. Multiple fixed versions available...

Philips Hue Bridge Pro

RISK EVALUATION The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker v2.0.22 that listens on all network interfaces with anonymous access enabled and no firewall restriction. An attacker with access to the Bridge's network can read device data and control connected lights...

Memory Allocation With Excessive Size Value

Apache ActiveMQ is vulnerable to Memory Allocation with Excessive Size Value. The vulnerability is due to improper validation of the encoded size of OpenWire message property maps during unmarshaling, which allows an authenticated attacker to send a crafted message with an excessively large size...

CVE-2026-65017

CVE-2026-65017 describes a masking bypass in Apache Airflow’s Config API in multi-team deployments. A Viewer with only configuration-read access could read a team-scoped Celery broker URL and its embedded credentials in cleartext, even though the global option is masked. The issue arises because ...

EUVD-2026-57272

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-65017 Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

PT-2026-71116

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-61366

Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally...

CVE-2026-61366

Affected component: Windows Network Connection Broker. Vulnerability: double free allows local privilege escalation by an authorized user. Root cause: double-free in the broker when handling network connection objects. Impact: high; local attacker with low privileges and no user interaction can e...

CVE-2026-61366 Windows Network Connection Broker Elevation of Privilege Vulnerability

...

CVE-2026-61366 Windows Network Connection Broker Elevation of Privilege Vulnerability

...

EUVD-2026-56328

Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally...

Windows Network Connection Broker Elevation of Privilege Vulnerability

Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally...

PT-2026-70436

Name of the Vulnerable Software and Affected Versions Windows Network Connection Broker affected versions not specified Description A double free issue in the Windows Network Connection Broker allows an authorized attacker to elevate privileges locally. A double free occurs when the system attemp...

GHSA-9HJ4-R449-HFVC vulnerabilities

Vulnerabilities for packages: pact-broker-docker-fips, ruby3.4-rails, cinc-auditor, logstash, pact-broker-docker, logstash-fips, ruby3.3-rails, ruby3.2-rails...

CVE-2026-71847 vulnerabilities

Vulnerabilities for packages: pact-broker-docker-fips, ruby3.4-rails, cinc-auditor, logstash, pact-broker-docker, logstash-fips, ruby3.3-rails, ruby3.2-rails...

CVE-2025-63235

A flaw was found in sol. The broker does not fully release resources when handling malformed or duplicate CONNECT packets. A remote attacker can send invalid CONNECT packets, which may cause the server to silently drop the connection or send a CONNACK without properly closing the session or...

EUVD-2025-210649

In sol commit 373d848 2024-12-12, the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK...

CVE-2026-18967

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...