Lucene search
+L

135 matches found

Kitploit
Kitploit
added 2026/09/07 8:43 a.m.5 views

vallumd

vallumd Este programa te permite centralizar y distribuir listas negras de IP. Si mantienes un servidor en Internet, es muy probable que te hayas encontrado con uno o más ataques de fuerza bruta. No hay problema, solo instala fail2ban. Hecho. Pero si tienes varios servidores, cada uno ejecutando ...

6.1AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/07 6:55 a.m.4 views

CVE-2026-2222-MQTT-Broker-CONNECT-Packet-Heap-Overflow

CVE-2026-2222 – Desbordamiento de montón en el paquete CONNECT de broker MQTT Código del programa C + Python root@kitploit: // mqttbrokersim.c - Simulated vulnerable MQTT broker include include include struct mqttconnect char protocolname8; uint8t protocollevel; uint8t flags; uint16t keepalive; /...

4.8CVSS5.7AI score0.00205EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/06 9:08 p.m.8 views

LazyMesh

LazyMesh Mesh routing system that supports using an OpenDHT proxy as the backend, so that nodes can communicate directly via the internet. Very early pre alpha, proof of concept, might not actually work, etc. This is meant for both hobby/HAM use cases, and more typical consumer/commercial IoT wor...

5.8AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/05 12:39 p.m.5 views

the-same-key-opens-every-box-cve-2026-71960-hard-coded-jwt-secret-in-cudy-wr3000-mesh-mqtt

CVE-2026-71960 — Secreto JWT hardcodeado en el broker MQTT mesh Cudy WR3000 2.0 Herramientas PoC para el artículo de Hunt-Benito "La misma clave abre todas las cajas: CVE-2026-71960 — Secreto JWT hardcodeado en el broker MQTT mesh WR3000 de Cudy"...

9.3CVSS5.9AI score0.03051EPSS
SaveExploits1
EUVD
EUVD
added 2026/09/04 12:00 a.m.5 views

EUVD-2026-71740

No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations...

5.5AI score0.00205EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/04 12:00 a.m.11 views

CVE-2026-79391

CVE-2026-79391 affects the MQTT service in Trueview 6.0.23.4 . The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations . No sp...

5.5AI score0.00205EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/09/04 12:00 a.m.10 views

PT-2026-86252

No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations...

5.5AI score0.00205EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/21 9:17 p.m.29 views

CVE-2026-43980 Malla: Stored XSS via Meshtastic node names in multiple frontend pages

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names longname, shortname received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtast...

6.3CVSS0.00184EPSS
SaveExploits0References3
GithubExploit
GithubExploit
added 2026/08/20 3:22 p.m.26 views

Exploit for CVE-2026-71960

CVE-2026-71960 — Hard-coded JWT Secret in Cudy WR3000 2.0 Mesh...

9.3CVSS5.8AI score0.03051EPSS
SaveExploits1
CVE
CVE
added 2026/08/20 2:35 p.m.90 views

CVE-2026-44725

In EMQX versions prior to 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, missing five-minute grant lifetime and SHA-256 package binding let a compromised admin/API key upload attacker-controlled Erlang code via POST /api/v5/plugins/install, achieving remote code execution. Patched in all listed ...

6.6CVSS5.5AI score0.00253EPSS
SaveExploits0References10
Cvelist
Cvelist
added 2026/08/20 2:35 p.m.36 views

CVE-2026-44725 EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute gran...

6.6CVSS0.00253EPSS
SaveExploits0References10
CVE
CVE
added 2026/08/19 2:28 p.m.31 views

CVE-2026-71961

Cudy WR3000 firmware before 2.5.24 is vulnerable: the sync_command binary passes unsanitized MQTT input to a shell sink in command.lua, allowing authenticated attackers with broker access to execute arbitrary root-level commands. CVSS 8.8 HIGH; update to firmware 2.5.24. No in-the-wild exploitati...

8.8CVSS6.1AI score0.03051EPSS
SaveExploits1References2
Vulnrichment
Vulnrichment
added 2026/08/19 2:27 p.m.9 views

CVE-2026-71960 Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the...

9.3CVSS5.6AI score0.00544EPSS
SaveExploits1References2
EUVD
EUVD
added 2026/08/19 2:27 p.m.12 views

EUVD-2026-62417

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the...

9.3CVSS5.6AI score0.00544EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2026/08/19 2:27 p.m.38 views

CVE-2026-71960 Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the...

9.3CVSS0.00544EPSS
SaveExploits1References2
Tenable Nessus
Tenable Nessus
added 2026/08/19 12:00 a.m.10 views

RHEL 10 : yggdrasil (RHSA-2026:57126)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57126 advisory. yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child worker...

8.8CVSS5.7AI score0.0034EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/08/19 12:00 a.m.14 views

PT-2026-78446

Name of the Vulnerable Software and Affected Versions Cudy WR3000 2.0 versions prior to 2.5.24 Description The Mosquitto MQTT broker authentication plugin contains a hard-coded JWT HMAC signing secret. This allows unauthenticated attackers to extract the secret from the firmware image and forge...

9.3CVSS5.6AI score0.00544EPSS
SaveExploits1References7
CVE
CVE
added 2026/08/13 7:00 p.m.44 views

CVE-2026-73669

The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfaces with anonymous access enabled and no firewall restriction. An unauthenticated attacker with network access to the bridge can read device data and control connected lights . ...

7.3CVSS5.4AI score0.00368EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/13 7:00 p.m.36 views

CVE-2026-73669 Signify Philips Hue Bridge Pro MQTT broker missing authentication

The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in...

7.3CVSS0.00368EPSS
SaveExploits0References4
ICS
ICS
added 2026/08/13 3:14 p.m.11 views

Philips Hue Bridge Pro

RISK EVALUATION The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker v2.0.22 that listens on all network interfaces with anonymous access enabled and no firewall restriction. An attacker with access to the Bridge's network can read device data and control connected lights...

7.3CVSS5.4AI score0.00368EPSS
SaveExploits0References1
Rows per page
Query Builder