CVE-2026-61387

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a...

CVE-2026-61387

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a...

CVE-2026-61387

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a...

CVE-2026-61387

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a...

CVE-2026-63252: Missing Release of Memory after Effective Lifetime

In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially...

CVE-2026-61387: Improper Cleanup on Thrown Exception

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a...

CVE-2026-62927: Incorrect Authorization

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...

CVE-2026-63248: Missing Authorization

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security...

CVE-2026-60007: Observable Response Discrepancy

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

CVE-2026-58080: Missing Authorization

In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy, sessions receive no role IDs and the default access controller skips role-permission check...

Fake shops target Winter Olympics 2026 fans

If you've seen the two stoat siblings serving as official mascots of the Milano Cortina 2026 Winter Olympics, you already know Tina and Milo are irresistible. Designed by Italian schoolchildren and chosen from more than 1,600 entries in a public poll, the duo has already captured hearts worldwide...

CVE-1999-0459

Local users can perform a denial of service in Alpha Linux, using MILO to force a reboot...

EUVD-2025-142521

Malicious code in butry-uty-milo npm...

EUVD-2025-142526

Malicious code in butry-toi-milo npm...

EUVD-1999-0458

Malware in sbrugna...

EUVD-2022-6805

Malicious code in bioql PyPI...

CVE-2024-52352 WordPress Postcasa Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in miloandrew Postcasa Shortcode postcasa allows DOM-Based XSS.This issue affects Postcasa Shortcode: from n/a through = 1.0...

CVE-2024-52352

CVE-2024-52352 is a DOM-based Cross-Site Scripting flaw in the WordPress plugin Postcasa Shortcode. The vulnerability affects Postcasa Shortcode versions up to 1.0 and is exploitable in an authenticated context (Contributor+). Descriptions from Red Hat and Wordfence corroborate that the issue ena...

MAL-2024-8077 Malicious code in milo-core-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c235fbc0abe4f5f5c994143c988c2bfd0a701e5664e62af0a373d40aeb0af8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in milo-core-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c235fbc0abe4f5f5c994143c988c2bfd0a701e5664e62af0a373d40aeb0af8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...