Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85724 | critical | 9.6 | No | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOpera... | 2026-09-25 |
| CVE-2026-95842 | high | 7.5 | No | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGro... | 2026-09-25 |
| CVE-2026-95843 | high | 7.5 | No | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscrip... | 2026-09-25 |
| CVE-2026-95845 | high | 7.5 | No | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message qu... | 2026-09-25 |
| CVE-2026-95846 | high | 7.5 | No | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying... | 2026-09-25 |
| CVE-2026-97228 | low | 2.7 | No | Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_... | 2026-09-25 |
| CVE-2026-78397 | medium | 4.0 | No | The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotecte... | 2026-09-25 |
| CVE-2026-78394 | medium | 4.1 | No | The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk... | 2026-09-25 |
| CVE-2026-78393 | medium | 6.1 | No | The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it... | 2026-09-25 |
| CVE-2026-88848 | medium | 4.2 | No | The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their memb... | 2026-09-25 |
| CVE-2026-86837 | medium | 5.3 | No | The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauth... | 2026-09-25 |
| CVE-2026-80514 | medium | 5.3 | No | The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them... | 2026-09-25 |
| CVE-2026-6088 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in R... | 2026-09-25 |
| CVE-2026-6087 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in R... | 2026-09-25 |
| CVE-2026-6086 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in R... | 2026-09-25 |
| CVE-2026-6085 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in R... | 2026-09-25 |
| CVE-2026-6084 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in R... | 2026-09-25 |
| CVE-2026-6083 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in R... | 2026-09-25 |
| CVE-2026-6082 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in R... | 2026-09-25 |
| CVE-2026-92106 | not reported | — | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XS... | 2026-09-25 |