Astra Linux – Vulnerability in ofono

A flaw was discovered in ofono, an open-source telephony software for Linux. A stack overflow bug occurs within the decodestatusreport function during SMS decoding. It is assumed that the attack scenario can be executed from a compromised modem, a malicious base station, or simply through SMS...

Astra Linux – Vulnerability in ofono

A flaw was discovered in ofono, an open-source telephony software for Linux. A stack overflow bug was detected within the smsdecodeaddressfield function during the SMS PDU decoding process. It is assumed that the attack scenario can be executed from a compromised modem, a malicious base station, ...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the DefaultJmsHeaderMapper process. An attacker can redirect handler output or error messages to arbitrary MessageChannel beans by setting crafted JMS properties such as replyChannel,...

CVE-2025-13909

WSO2 Identity Server is reported to have a multi-tenant authentication flaw where requests using Email OTP, SMS OTP, or Magic Link as first factors do not adequately enforce tenant isolation. This can allow an attacker to disclose PII from other tenants (e.g., mobile numbers) due to cross-tenant ...

CVE-2026-66349 MZ Automation libiec61850 Out-of-bounds Read

The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder may advance its internal buffer incorrectly due to a missing bounds check. This...

Unauthenticated Java Message Broker - Detect

Detection of a Java Message Service JMS broker, typically used by Oracle GlassFish Message Queue and Payara Application Server. This port should remain closed to the internet, as it enables unauthenticated access to messaging services. !/usr/bin/env python3 -- coding: utf-8 -- """Detection of a...

PT-2026-64932

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...

PT-2026-63851

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.6 versions...

devops-message-service-project-2022 (>=1.2.0, <=1.3.0), quantplay (>=1.4.51, <=1.4.53) +1 more potentially affected by CVE-2026-48809 via python-engineio (3.13.0)

python-engineio PYPI version 3.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-engineio and may be impacted: - devops-message-service-project-2022 =1.2.0, =1.4.51, =1.0.2, =1.0.4 Source cves: CVE-2026-48809 Source advisory: OSV:PYSEC-2026-3...

devops-message-service-project-2022 (>=1.2.0, <=1.3.0), quantplay (>=1.4.51, <=1.4.53) +1 more potentially affected by CVE-2026-48802 via python-engineio (3.13.0)

python-engineio PYPI version 3.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-engineio and may be impacted: - devops-message-service-project-2022 =1.2.0, =1.4.51, =1.0.2, =1.0.4 Source cves: CVE-2026-48802 Source advisory: OSV:PYSEC-2026-3...

Exploit for Deserialization of Untrusted Data in Apache Camel

camel-jms Forged DefaultExchangeHolder Filter-Bypass Reproduce...

Exploit for Deserialization of Untrusted Data in Apache Camel

camel-jms JMS ObjectMessage Unsafe Deserialization Reproducer...

cxf: org.apache.cxf/cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration

A flaw was found in Apache CXF. This vulnerability, stemming from an incomplete fix for a previous issue, allows untrusted users who can configure Java Message Service JMS for Apache CXF to achieve arbitrary code execution. This could lead to a complete compromise of the affected system...

CVE-2026-43866

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

CVE-2026-43866

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject whenever the...

CVE-2026-43866

Apache Camel's camel-jms , camel-sjms , camel-sjms2 , camel-amqp , camel-activemq , and camel-activemq6 components are vulnerable to a deserialization of untrusted data (CWE-502) bypass of CVE-2026-40860. The JmsBinding.extractBodyFromJms() function deserializes incoming jakarta.jms.ObjectMessage...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the rendering of the browse page in the web console, where message IDs are displayed without proper sanitization. An attacker can execute arbitrary HTML or JavaScript code in the browser of an administrator b...

UBUNTU-CVE-2026-52760

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a J...

devops-message-service-project-2022 (>=1.2.0, <=1.3.0), quantplay (>=1.4.51, <=1.4.53) +1 more potentially affected by CVE-2026-48802 via python-engineio (3.13.0)

python-engineio PYPI version 3.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-engineio and may be impacted: - devops-message-service-project-2022 =1.2.0, =1.4.51, =1.0.2, =1.0.4 Source cves: CVE-2026-48802 Source advisory:...

devops-message-service-project-2022 (>=1.2.0, <=1.3.0), quantplay (>=1.4.51, <=1.4.53) +1 more potentially affected by CVE-2026-48809 via python-engineio (3.13.0)

python-engineio PYPI version 3.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-engineio and may be impacted: - devops-message-service-project-2022 =1.2.0, =1.4.51, =1.0.2, =1.0.4 Source cves: CVE-2026-48809 Source advisory:...