Linux Distros Unpatched Vulnerability : CVE-2026-67221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials...

PT-2026-97938

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ACPI bus. The function acpi get first physical node may return a stale device pointer because acpi unbind one can execute after the ACPI device's...

PT-2026-97904

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description On LoongArch architectures, the kernel fails to define DIRECT MAP PHYSMEM END, causing get free mem region and mhp get pluggable range to use a compile-time constant fallback that does n...

PT-2026-97967

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the greybus audio component where the gb audio gb get topology function fetches a topology blob based on a size supplied by a module. The gbaudio tplg parse data...

AZL-105738 CVE-2026-67221 affecting package rabbitmq-server 3.13.7-9

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

CVE-2026-67221

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

CVE-2026-67221

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

DEBIAN-CVE-2026-67221

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

UBUNTU-CVE-2026-67221

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

CVE-2026-67221 RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

CVE-2026-67221

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

CVE-2026-67221 RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

CVE-2026-67221

RabbitMQ is a messaging and streaming broker vulnerable to the exposure of plaintext passwords in AMQP 1.0 shovels . In versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 , the system fails to remove credentials from the connection URI before storage, unlike the AMQP 0-9-1 shovel. This a...

EUVD-2026-85666

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

CVE-2026-67221 RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

CVE-2026-86064

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in...

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

Summary The unauthenticated WebSocket endpoint GET /subscribe is registered open: true by default config/node/api.yaml and lets a remote, unauthenticated client exhaust the node's memory and goroutines. Because the REST API runs IN-PROCESS with the node — network/api/api.go Start... ends with...

GHSA-4FWH-WRM6-97XM Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

Summary The unauthenticated WebSocket endpoint GET /subscribe is registered open: true by default config/node/api.yaml and lets a remote, unauthenticated client exhaust the node's memory and goroutines. Because the REST API runs IN-PROCESS with the node — network/api/api.go Start... ends with...

EUVD-2026-85575

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has n...

CVE-2026-86065

Klever-Go , the Go implementation of the Klever blockchain protocol, is vulnerable to remote denial-of-service (DoS) via the unauthenticated GET /subscribe endpoint prior to version 1.7.20 . The vulnerability stems from three compounding gaps: permissive origin handling (allowing any web origin),...