62 matches found
DEBIAN-CVE-2026-101003
A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The...
CVE-2026-101003
A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The...
EUVD-2026-88089
A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The...
CVE-2026-101003 Cesanta Mongoose MQTT Broker main.c fn stack-based overflow
A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The...
Unity Linux 20.1060e / 20.1070e Security Update: curl (UTSA-2026-017589)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017589 advisory. When sending data to an MQTT server, libcurl = 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use...
PT-2026-7834
Name of the Vulnerable Software and Affected Versions SolaX devices affected versions not specified Description Devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in Alibaba Cloud mqtt001.solaxcloud.com, TCP 8883. This allows attackers in a...
CVE-2025-15574: Use of Insufficiently Random Values
When connecting to the Solax Cloud MQTT server the username is the "registration number", which is the 10 character string printed on the SolaX Power Pocket device / the QR code on the device. The password is derived from the "registration number" using a proprietary XOR/transposition algorithm...
CVE-2025-56558: Unprotected Alternate Channel
The Dyson MQTT server 2022 and possibly later allows publications and subscriptions by a client that has the correct values of AWSACCESSKEYID, AWSSECRETACCESSKEY, AWSSESSIONTOKEN, and device serial number, even if a device such as a Pure Hot+Cool device has been removed and is not visible in the...
JLSEC-2025-29 When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances...
When sending data to an MQTT server, libcurl = 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it again...
EUVD-2021-10073
Malware in sbrugna...
EUVD-2019-0656
Malware in sbrugna...
EUVD-2018-11109
Malware in sbrugna...
EUVD-2025-16053
Malicious code in bioql PyPI...
EUVD-2021-2848
Malicious code in bioql PyPI...
Telpo MDM 安全漏洞
Telpo MDM is a mobile device management system from the Chinese company Telpo. A security vulnerability exists in Telpo MDM versions 1.4.6 to 1.4.9, which originates from the plaintext storage of administrator credentials and MQTT server details, and could lead to unauthorized access...
CVE-2025-55443: Cleartext Storage of Sensitive Information
Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details IP/port that are stored in plaintext within log files on the device's external storage. This allows attackers with access to these logs to: 1. Authenticate to the MDM web platfor...
CVE-2025-27803
The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actions and reconfigure the devices or potentially gain access ...
PT-2025-22331 · Echarge Hardy Barth · Cph2 / Cpp2 Charging Stations
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns a lack of authentication for the web interface or the MQTT server. This allows an attacker with network access to gain administrative access, perform arbitrary...
CVE-2025-27803: Missing Authentication for Critical Function
The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actions and reconfigure the devices or potentially gain access ...