CVE-2026-49363

Apache ActiveMQ Artemis is vulnerable to a pre-authentication topology disclosure vulnerability due to a missing authentication check in the SUBSCRIBE_TOPOLOGY_V2 handler within CoreProtocolManager.LocalChannelHandler.handlePacket() . An unauthenticated attacker can send a single 5-byte packet vi...

CVE-2026-49363 Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBETOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are...

EUVD-2026-75249

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBETOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are...

CVE-2026-57967 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

An unauthenticated remote attacker can craft a CORE protocol SESSIONREATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0...

EUVD-2026-75246

An unauthenticated remote attacker can craft a CORE protocol SESSIONREATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0...

CVE-2026-57967

An unauthenticated remote attacker can exploit a session hijack vulnerability in Apache Artemis (versions 2.50.0 through 2.56.0) and Apache ActiveMQ Artemis (versions 1.0.0 through 2.44.0). The REATTACH_SESSION handler performs zero authentication, looking up sessions by name only and calling tra...

CVE-2026-57967 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

An unauthenticated remote attacker can craft a CORE protocol SESSIONREATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0...

CVE-2026-67593 Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ...

EUVD-2026-75245

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ...

CVE-2026-67593 Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ...

CVE-2026-67593

An unauthenticated network attacker can delete arbitrary durable queues on an Apache Artemis broker (or Apache ActiveMQ Artemis ) with the OpenWire protocol enabled. The vulnerability exists because the processRemoveSubscription() method executes pre-authentication without authorization checks, u...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

SUSE CVE-2026-86205

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a...

PT-2026-89275

Name of the Vulnerable Software and Affected Versions Apache Artemis versions 2.50.0 through 2.56.0 Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 Description An unauthenticated remote attacker can create arbitrary durable queues using the CORE protocol. This allows for unauthorized...

PT-2026-89318

🚨 HIGH: CVE-2026-88277 CVSS 8.8 - GeoVision GV-LPC2211 V1.13 vulnerable to authenticated command injection via ONVIF. Attackers can execute arbitrary commands as root. Patch immediately. CVE Vulnerability PatchNow https://t.co/0HQ3GCjvsH...

From Specs to Apps: Verifying and Monitoring Models of Signal and WhatsApp

The Signal protocol is a prominent messaging protocol that secures communication for billions of users. It powers WhatsApp, the most widely used messaging application worldwide, and the Signal app, popular among privacy-conscious users. Extensive research in the computational and Dolev-Yao settin...

PT-2026-89312

GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR...

CVE-2026-49363: Missing Authentication for Critical Function

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBETOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are...

PT-2026-89276

Name of the Vulnerable Software and Affected Versions Apache Artemis versions 2.50.0 through 2.56.0 Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 Description An unauthenticated remote attacker using the CORE protocol can discover cluster node details by sending a SUBSCRIBE TOPOLOGY reques...

CVE-2026-49362: Missing Authentication for Critical Function

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users...