CVE-2026-67407 RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex...

nats-server: NATS Server: Information disclosure due to inconsistent MQTT topic rechecking

A flaw was found in NATS Server. This vulnerability allows for unauthorized information disclosure where MQTT messages, intended to be denied based on subscription rules, are still delivered to subscribers. This occurs because the server's delivery paths do not consistently recheck the original...

nats-server: NATS Server: Information disclosure due to inconsistent MQTT topic rechecking

A flaw was found in NATS Server. This vulnerability allows for unauthorized information disclosure where MQTT messages, intended to be denied based on subscription rules, are still delivered to subscribers. This occurs because the server's delivery paths do not consistently recheck the original...

BIT-RABBITMQ-2026-44838 RabbitMQ MQTT Topic Permission Authorization Bypass

RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions with variable substitution. Administrators can create patterns such as ^clientid-sensors$ to restrict user access to topics that include...

CVE-2026-44838

RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions with variable substitution. Administrators can create patterns such as ^clientid-sensors$ to restrict user access to topics that include...

CVE-2026-33009

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to C++ UB potential memory corruption. This is triggered by an MQTT everestexternal/nodered/connector/cmd/switchthreephaseswhilecharging message and results in Charger::sharedcontext / internalcontext...

CVE-2025-11757: Improper Neutralization of Wildcards or Matching Symbols

The CloudEdge Cloud does not sanitize the MQTT topic input, which could allow an attacker to leverage the MQTT wildcard to receive all the messages that should be delivered to other users by subscribing to the a MQTT topic. In these messages, the attacker can obtain the credentials and key...

EUVD-2017-18778

Malware in sbrugna...

EUVD-2018-12263

Malware in sbrugna...

EUVD-2025-15995

Malicious code in bioql PyPI...

CVE-2025-27804

Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions...

CVE-2023-1083

An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates...

CVE-2025-27804

Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions...

CVE-2025-27804

The eCharge Hardy Barth cPH2 and cPP2 electric vehicle charging stations (version 2.2.0 ) are vulnerable to multiple security flaws, including OS command injection. The root cause lies in the /var/salia/mqtt.php script within the device firmware, where publishing a specially crafted message to a ...

PT-2025-22332

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description There are several OS command injection vulnerabilities in the device firmware, specifically in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic...

CVE-2025-27804: Improper Neutralization of Special Elements used in an OS Command

Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions...

Welotec Industrial Routers Missing Authentication for Critical Function (CVE-2023-1083)

An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

F5 Networks BIG-IP : BIG-IP MQTT iRule vulnerability (K62830532)

When your system handlesMQTT traffic through a BIG-IP virtual server associated with an MQTT profile, and an iRule performs manipulations on that traffic, TMM may produce a core file. CVE-2020-5935 Impact The Traffic Management Microkernel TMM may generate a core file and restart, causing a high...

CVE-2018-1684: Undefined Security Weakness

IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that can cause a denial of service attack. IBM X-Force ID: 145456...

Debian DLA-1146-1 : mosquitto security update

mosquitto's persistence file mosquitto.db was created in a world-readable way thus allowing local users to obtain sensitive MQTT topic information. While the application has been fixed to set proper permissions by default, you still have to manually fix the permissions on any existing file. For...