CVE-2026-68140

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucvpath afiucv queues not-yet-received message notifications on iucv-messageq, each holding a raw pointer to the connection's iucvpath. When the peer severs the connection, iucvseverpath...

EUVD-2026-55522

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucvpath afiucv queues not-yet-received message notifications on iucv-messageq, each holding a raw pointer to the connection's iucvpath. When the peer severs the connection, iucvseverpath...

CVE-2026-68140 net/iucv: fix use-after-free of a severed iucv_path

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucvpath afiucv queues not-yet-received message notifications on iucv-messageq, each holding a raw pointer to the connection's iucvpath. When the peer severs the connection, iucvseverpath...

CVE-2026-68140 net/iucv: fix use-after-free of a severed iucv_path

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucvpath afiucv queues not-yet-received message notifications on iucv-messageq, each holding a raw pointer to the connection's iucvpath. When the peer severs the connection, iucvseverpath...

CVE-2026-66404

The CVE-2026-66404 issue affects DEEBOT PRO M1 and DEEBOT PRO K1VAC where the MQTT client does not validate server certificates, enabling potential unauthorized access to operation and activity logs stored on the device. The vulnerability is categorized as missing server certificate verification ...

CVE-2026-5857

Contiki-NG's MQTT client parsepublishvhdr in os/net/app-layer/mqtt/mqtt.c sets topiclenreceived=1 before checking topiclen against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcpinput re-invokes the parser with topicreceived==0, and t...

EUVD-2026-51027

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

CVE-2026-44092 Missing input validation / stripping of CRLF characters in SystemConfigManager

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

CVE-2026-44090

CVE-2026-44090 describes a lack of authentication exposing an MQTT broker to unauthenticated remote access. The broker is only protected by an external firewall, enabling a network attacker to potentially take full control of the device. Documented impact includes high confidentiality, integrity,...

The vulnerability of the Microsoft Windows operating system’s message queue dispatcher allows a hacker to execute arbitrary code.

The vulnerability of the message queue dispatcher in Microsoft Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2026-66027

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...

EUVD-2026-48641

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...

CVE-2026-66027 Suna < 0.9.102 Broken Access Control via Message Queue API

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...

CVE-2026-66027

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...

CVE-2026-66027 Suna < 0.9.102 Broken Access Control via Message Queue API

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...

CVE-2026-66027

The CVE-2026-66027 entry documents a broken access control in Suna

rabbitmq-server: RabbitMQ: Authorization bypass via regular expression injection in MQTT client ID

A flaw was found in RabbitMQ. An authenticated MQTT Message Queuing Telemetry Transport user can bypass topic-level authorization by injecting regular expression operators. This occurs because the client ID, provided by the user in the MQTT CONNECT packet, is inserted into authorization regex...

CVE-2026-63767

ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can...

CVE-2026-63767 ktransformers Unauthenticated Pickle Deserialization RCE via ZMQ

ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can...

Incorrect Authorization

Overview github.com/nats-io/nats-server/server is an A simple, secure and performant communications system for digital systems, services and devices. Affected versions of this package are vulnerable to Incorrect Authorization in the MQTT retained message delivery and QoS1+ durable replay process...