PT-2026-67894

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.6.6 OpenSIPS versions prior to 4.0.0-rc1 Description A denial of service issue exists in the watcherinfo generation functionality. A remote attacker can crash an OpenSIPS worker by sending a SUBSCRIBE Event: presen...

PT-2026-76183

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these...

CVE-2026-15052 MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-51759

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15052

Affected software: MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress (versions ≤ 4.3.3). Vulnerability type & root cause: Stored Cross‑Site Scripting due to insufficient input sanitization and output escaping in form field handling. Impact: Unauthenticated ...

CVE-2026-15052: Improper Neutralization of Input During Web Page Generation

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-67058

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-10685 Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...

CVE-2026-10685 Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...

CVE-2026-10685

CVE-2026-10685 : In Zephyr, the GATT client CCC-write response handler gatt_write_ccc_rsp() may call the application’s params-&gt;subscribe() after already invoking params-&gt;notify(conn, params, NULL, 0). A NULL data notify signals termination; calling subscribe() on the same bt_gatt_subscribe_...

PT-2026-66758

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description In the Bluetooth GATT client, the CCC-write response handler gatt write ccc rsp in subsys/bluetooth/host/gatt.c invokes the params-subscribe callback after calling params-notifyconn, params,...

NTFY Web - Exposure Detection

Publicly exposed NTFY web interface allowing unauthorized publish or subscribe access. !/usr/bin/env python3 -- coding: utf-8 -- """Publicly exposed NTFY web interface allowing unauthorized publish or subscribe access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

MQTT Broker Detection

Detects MQTT brokers on TCP 1883 and tests anonymous subscribe access. !/usr/bin/env python3 -- coding: utf-8 -- """Detect MQTT brokers on plaintext TCP 1883.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.mqtt.detectors import...

CVE-2026-47016

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Event Publish and Subscribe. Supported versions that are affected are 17.0-26.4. Difficult to exploit vulnerability allows physical access to compromise Siebel CRM Integration. While the vulnerability is in Siebel...

CVE-2026-47016: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Event Publish and Subscribe. Supported versions that are affected are 17.0-26.4. Difficult to exploit vulnerability allows physical access to compromise Siebel CRM Integration. While the vulnerability is in Siebel...

CVE-2026-35217 NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Read

NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling: if a subscription entry is missing the final 1-byte Subscription Options field, the broker may still accept the malformed packet and install the subscription into internal broker state. Under a specific packet-length...

CVE-2026-35217 NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Read

NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling: if a subscription entry is missing the final 1-byte Subscription Options field, the broker may still accept the malformed packet and install the subscription into internal broker state. Under a specific packet-length...

CVE-2026-35217

NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling: if a subscription entry is missing the final 1-byte Subscription Options field, the broker may still accept the malformed packet and install the subscription into internal broker state. Under a specific packet-length...

EUVD-2026-46021

NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling: if a subscription entry is missing the final 1-byte Subscription Options field, the broker may still accept the malformed packet and install the subscription into internal broker state. Under a specific packet-length...

CVE-2026-35217 NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Read

NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling: if a subscription entry is missing the final 1-byte Subscription Options field, the broker may still accept the malformed packet and install the subscription into internal broker state. Under a specific packet-length...