CVE-2026-121564

Incomplete Comparison with Missing Factors CWE-1023 in mergechats whatstk/utils/chatmerge.py, reached from BaseChat.merge, in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was...

EUVD-2026-115913

Incomplete Comparison with Missing Factors CWE-1023 in mergechats whatstk/utils/chatmerge.py, reached from BaseChat.merge, in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was...

CVE-2026-121564

The whatstk library (versions 0.3.0 before 0.9.0 ) is vulnerable to a silent loss of messages during chat export merging via CWE-1023 . The issue resides in the merge_chats() function within whatstk/utils/chat_merge.py, which is reachable from BaseChat.merge(). Because the logic compares date ran...

CVE-2026-121564 Silent loss of messages when merging overlapping chat exports in whatstk

Incomplete Comparison with Missing Factors CWE-1023 in mergechats whatstk/utils/chatmerge.py, reached from BaseChat.merge, in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was...

CVE-2026-121564: lucasrodes whatstk: Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from…

Incomplete Comparison with Missing Factors CWE-1023 in mergechats whatstk/utils/chatmerge.py, reached from BaseChat.merge, in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was...

Apache Pulsar authorization issue vulnerability

Versions 2.8.0 through 4.0.14 and 4.1.0 through 4.2.5 of Apache Pulsar contain an authorization issue vulnerability. This vulnerability arises because when performing a truncate operation on a topic partition, no check is performed to verify whether the caller possesses tenant administrator...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: account for netlink header size This is a follow-up to an old bug fix: NLMSGDONE needs to account for the netlink header size, not just the attribute size. This can result in a WARN splat + drop of the...

CVE-2026-67412

A flaw was found in RabbitMQ. The Federation feature fails to enforce virtual host vhost authorization checks when validating upstream connections. An authenticated user with policy configuration privileges in one vhost can exploit this flaw by targeting another vhost where they lack permissions...

CVE-2026-95847

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

EUVD-2026-85417

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

CVE-2026-95847 Moquette client IDs can cause cross-session H2 durable-queue corruption

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

CVE-2026-95847 Moquette client IDs can cause cross-session H2 durable-queue corruption

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

CVE-2026-95847

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

CVE-2026-95847

Prior to version 0.18.1 , the Moquette Java MQTT broker is vulnerable to a cross-session data collision in the H2PersistentQueue component. The vulnerability arises because the broker derives message-map and metadata-map names using the client ID. A durable session with a client ID ending in _met...

CVE-2026-95847 Moquette client IDs can cause cross-session H2 durable-queue corruption

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

PT-2026-97398

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description In the H2PersistentQueue component, session message-map names are derived using the prefix queue followed by the client ID, while metadata-map names use queue , the client ID, and the suffix meta. ...

CVE-2026-95847: Improper Control of Resource Identifiers

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

rabbitmq-server: RabbitMQ: Unauthorized cross-vhost message access via missing Federation upstream authorization

A flaw was found in RabbitMQ. The Federation feature fails to enforce virtual host vhost authorization checks when validating upstream connections. An authenticated user with policy configuration privileges in one vhost can exploit this flaw by targeting another vhost where they lack permissions...

EUVD-2008-7065

Malware in sbrugna...

Microchip RN4870 security vulnerability

The Microchip RN4870 is a Bluetooth low power module chip from Microchip, Inc. A security vulnerability exists in the Microchip RN4870 module firmware version 1.43, which originates from accepting PauseEncReqPlainText before pairing is complete, the low-power Bluetooth implementation enters a...