CVE-2026-105927

The Apache Pulsar WebSocket service (versions 2.3.0 before 4.0.14 and 4.1.0 before 4.2.5) contains an improper authorization vulnerability. An authenticated user with CONSUME permissions on a subscribed topic can exploit the deadLetterTopic query parameter to inject messages into arbitrary topics...

CVE-2026-95846

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2026-95846 Moquette publishes Last-Will messages without enforcing write authorization

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2026-95846 Moquette publishes Last-Will messages without enforcing write authorization

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

EUVD-2026-85416

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2026-95846

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2026-95846

The Moquette lightweight Java MQTT broker is vulnerable to unauthorized message injection in versions prior to 0.18.1 . The PostOffice.publishWill function fails to apply canWrite authorization and reserved-topic checks when publishing a client's Last-Will message. This allows a client to configu...

CVE-2026-95846 Moquette publishes Last-Will messages without enforcing write authorization

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

PT-2026-97397

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description An issue exists where the PostOffice.publishWill function publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks typically required for a norma...

CVE-2026-95846: Missing Authorization

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2020-1996

A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the management server ms.log file. This vulnerability can be leveraged to obfuscate an ongoing attack or fabricate log entries in the ms.log fil...