Exploit for CVE-2026-71960

CVE-2026-71960 — Hard-coded JWT Secret in Cudy WR3000 2.0 Mesh...

CVE-2026-44725 EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute gran...

CVE-2026-44725

In EMQX versions prior to 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, missing five-minute grant lifetime and SHA-256 package binding let a compromised admin/API key upload attacker-controlled Erlang code via POST /api/v5/plugins/install, achieving remote code execution. Patched in all listed ...

EUVD-2026-62934

In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see...

EUVD-2026-62921

In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a...

CVE-2026-76369

In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see...

CVE-2026-76356

In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a...

CVE-2026-76369 Path Traversal through Automation Broker in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see...

CVE-2026-76369

CVE-2026-76369 is a path traversal vulnerability in Splunk SOAR versions below 8.6.0 . A user holding the OnPrem Broker role can write files outside the intended Automation Broker log directory by supplying crafted filename input during log uploads. The root cause is insufficient validation of fi...

CVE-2026-76356 Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a...

CVE-2026-76356

Splunk SOAR versions below 8.6.0 are vulnerable: the Automation Broker trusts a client-supplied source IP header, allowing an unauthenticated attacker to spoof the local system IP and execute arbitrary code on the host. CVSS 8.1 (HIGH). No exploit code or in-the-wild exploitation is documented. U...

CVE-2026-71961

Cudy WR3000 firmware before 2.5.24 is vulnerable: the sync_command binary passes unsanitized MQTT input to a shell sink in command.lua, allowing authenticated attackers with broker access to execute arbitrary root-level commands. CVSS 8.8 HIGH; update to firmware 2.5.24. No in-the-wild exploitati...

EUVD-2026-62417

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the...

CVE-2026-71960 Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the...

PT-2026-78796

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the OnPrem Broker role can write files outside the designated Automation Broker log directory. This occurs because the Automation Broker log upload process accepts crafted filename...

UBUNTU-CVE-2026-61634

The RabbitMQ Java client library allows Java and JVM-based application...

RHEL 10 : yggdrasil (RHSA-2026:57126)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57126 advisory. yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child worker...

PT-2026-78783

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An unauthenticated user can execute arbitrary code on the host by spoofing the source IP address in a crafted request to an Automation Broker notification endpoint. This occurs because the...

PT-2026-78446

Name of the Vulnerable Software and Affected Versions Cudy WR3000 2.0 versions prior to 2.5.24 Description The Mosquitto MQTT broker authentication plugin contains a hard-coded JWT HMAC signing secret. This allows unauthenticated attackers to extract the secret from the firmware image and forge...

CVE-2026-60831

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Integration Broker. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterpris...