BIT-RABBITMQ-2026-67411 RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopbackusers, causing th...

BIT-RABBITMQ-2026-67405 RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmqwebmqtt/src/rabbitwebmqtthandler.erl:104 nor the Web-STOMP handler deps/rabbitmqwebstomp/src/rabbitwebstomphandler.erl:102 validates the Origin head...

BIT-RABBITMQ-2026-67232 RabbitMQ: Web-MQTT decompression bomb

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

EUVD-2026-90570

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x attacker-chosen name matching the form's url. predefined value' parameter in all versions up to, and includin...

CLEANSTART-2024-EG50612 Chromium: CVE-2021-30608 Use after free in Web Share

Security vulnerability affects the chromium package. Chromium: CVE-2021-30608 Use after free in Web Share...

CVE-2026-78249

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...

CLEANSTART-2024-NN66472 Use after free in Web Search in Google Chrome prior to 98

Security vulnerability affects the chromium package. Use after free in Web Search in Google Chrome prior to 98...

CLEANSTART-2024-TC05917 Heap buffer overflow in Web UI Settings in Google Chrome prior to 101

Security vulnerability affects the chromium package. Heap buffer overflow in Web UI Settings in Google Chrome prior to 101...

CLEANSTART-2024-GQ88613 Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101

Security vulnerability affects the chromium package. Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101...

CLEANSTART-2024-WU30309 Inappropriate implementation in Web Contents in Google Chrome prior to 101

Security vulnerability affects the chromium package. Inappropriate implementation in Web Contents in Google Chrome prior to 101...

CVE-2026-78249

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...

CVE-2026-78249

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...

EUVD-2026-90549

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...

CVE-2026-78249

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers , including Apeos C4571 (version 1.1.3 and earlier) and Apeos C3567 (version 1.1.3). The root cause is the insecure handling of externally supplied parameters , which may allow a s...

CLEANSTART-2024-NV58280 logic error in the room key sharing functionality of Element Android before 1

Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of Element Android before 1...

CLEANSTART-2024-FT51773 logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12

Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12...

CLEANSTART-2024-KG85356 matrix-react-sdk is a Matrix chat protocol SDK for React Javascript

Security vulnerability affects the element-web package. matrix-react-sdk is a Matrix chat protocol SDK for React Javascript...

CLEANSTART-2024-IV81629 matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript

Security vulnerability affects the element-web package. matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript...

CLEANSTART-2024-EM09581 Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript

Security vulnerability affects the element-web package. Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript...

CLEANSTART-2024-VR88487 Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript

Security vulnerability affects the element-web package. Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript...