CVE-2026-95847

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

EUVD-2026-85417

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

CVE-2026-95847

Prior to version 0.18.1 , the Moquette Java MQTT broker is vulnerable to a cross-session data collision in the H2PersistentQueue component. The vulnerability arises because the broker derives message-map and metadata-map names using the client ID. A durable session with a client ID ending in _met...

PT-2026-97398

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description In the H2PersistentQueue component, session message-map names are derived using the prefix queue followed by the client ID, while metadata-map names use queue , the client ID, and the suffix meta. ...

CVE-2026-95847: Improper Control of Resource Identifiers

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

CVE-2026-18322 Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator

The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the havePermissions function in classes/frame.php, where arraymerge overwrites the popup module's...

CVE-2026-18322

The Smart Popup by Supsystic WordPress plugin (versions ↜ 1.13.0 ) is vulnerable to unauthenticated privilege escalation leading to the creation of a persistent Administrator account. The root cause is a permission map collision in the havePermissions() function within classes/frame.php, where ar...

DEBIAN-CVE-2026-59880

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such a...

CVE-2026-59880

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such a...