CVE-2026-98525

A flaw was found in the Linux kernel's Management Component Transport Protocol MCTP subsystem. When looking up preallocated communication tags, the kernel fails to verify that a requested tag belongs to the calling socket and instead searches across the entire network namespace. A local attacker...

CVE-2026-67241

A flaw was found in rabbitmq-server. This vulnerability allows an authenticated user to bypass access controls and perform unauthorized message routing. When an exchange is declared via the Advanced Message Queuing Protocol AMQP 1.0 management interface, the application fails to verify write...

EUVD-2026-87244

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...

camel-aws2-sqs: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

A flaw was found in Apache Camel AWS2-SQS Component. This vulnerability allows a remote attacker, with permissions to send messages to a consumed SQS queue, to inject arbitrary Camel control headers into the message exchange. This is due to a missing inbound header filter strategy. The injected...

EUVD-2026-86293

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/sessionId/qr requires the...

CVE-2026-95846

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2026-95846 Moquette publishes Last-Will messages without enforcing write authorization

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

EUVD-2026-85416

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2026-95846

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2026-95846

The Moquette lightweight Java MQTT broker is vulnerable to unauthorized message injection in versions prior to 0.18.1 . The PostOffice.publishWill function fails to apply canWrite authorization and reserved-topic checks when publishing a client's Last-Will message. This allows a client to configu...

CVE-2026-95846 Moquette publishes Last-Will messages without enforcing write authorization

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2026-95846 Moquette publishes Last-Will messages without enforcing write authorization

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

PT-2026-97397

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description An issue exists where the PostOffice.publishWill function publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks typically required for a norma...

CVE-2026-95846: Missing Authorization

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

PT-2026-93862

Name of the Vulnerable Software and Affected Versions ContiNew Admin versions prior to 4.1.1 Description An authorization bypass exists in the personal message delete endpoint. Authenticated users can delete messages and announcements belonging to other users by providing arbitrary message...

rabbitmq-server: rabbitmq-server: Unauthorized message routing via missing alternate-exchange permission check

A flaw was found in rabbitmq-server. This vulnerability allows an authenticated user to bypass access controls and perform unauthorized message routing. When an exchange is declared via the Advanced Message Queuing Protocol AMQP 1.0 management interface, the application fails to verify write...

rabbitmq-server: RabbitMQ: Unauthorized cross-vhost message access via missing Federation upstream authorization

A flaw was found in RabbitMQ. The Federation feature fails to enforce virtual host vhost authorization checks when validating upstream connections. An authenticated user with policy configuration privileges in one vhost can exploit this flaw by targeting another vhost where they lack permissions...

PT-2026-64439

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.9.9 Description An authenticated user can overwrite the content of messages in channels they do not belong to, including private and direct message channels. This occurs when a chat completion request is sen...

CVE-2026-32995: Improper Access Control

The Rocket.Chat DDP method autoTranslate.translateMessage in versions 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.5, 7.13.8, and 7.10.12 accepts a client-supplied IMessage object and passes it directly to translateMessage without checking Meteor.userId or verifying room membership. Any authenticated D...

CVE-2026-2488

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized message deletion due to a missing capability check on the pgdeletemsg function in all versions up to, and including, 5.9.8.1. This is due to the function not verifying that the requesting us...