CVE-2026-67413 affects RabbitMQ server versions prior to 4.0.23, 4.1.14, 4.2.9, and 4.3.3 when using the optional rabbitmq_jms_topic_exchange plugin. The vulnerability arises from the x-jms-topic exchange accepting a client-controlled binding expression that uses a LIKE evaluator expanding wildcards into overlapping PCRE fragments. This leads to unbounded execution of regular expressions without limits, allowing an authenticated tenant with binding and publishing permissions to consume excessive CPU resources and cause denial of service. The issue is fixed in RabbitMQ versions 4.0.23, 4.1.14, 4.2.9, and 4.3.3.
CVE-2026-67415 affects RabbitMQ versions from 4.2.0 up to but not including 4.2.9 and 4.3.3. The vulnerability involves the Shovel parameter parser converting attacker-controlled runtime parameter values into Erlang atoms without proper bounding or allowlist checks. Exploitation requires network access to the Management HTTP API, valid credentials with management and policymaker tags, permission to set Shovel runtime parameters, and enabled shovel plugins. Successful exploitation can exhaust the node-wide atom table, causing a denial of service. Malicious parameters persist and reapply atom pressure after restarts. The issue is fixed in versions 4.2.9 and 4.3.3.
RabbitMQ versions prior to 4.3.5 contain a vulnerability where an authenticated user who can bind a queue to a topic exchange and publish to it can exploit consecutive '#' segments in a binding key. This causes the topic matchers to revisit the same trie-node and routing-key-suffix states without memoization, leading to duplicate destination materialization before deduplication. The resulting combinatorial CPU and memory load can disrupt routing for all tenants. This issue is fixed in version 4.3.5.
RabbitMQ versions from 3.13.0 up to but not including 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5 contain a vulnerability where OAuth credential refresh retains revoked runtime impersonator tags. This allows an AMQP connection that once had impersonator privileges to continue using those privileges after a token refresh, even if the new token no longer grants them. The issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
RabbitMQ versions from 3.13.0 up to but not including 3.13.19, and certain 4.x versions including 4.0.24, 4.1.15, 4.2.10, and 4.3.5, have a vulnerability in the RabbitMQ Management plugin when the OAuth management UI is enabled. This vulnerability allows an attacker with queue configure permission and a management administrator with limited queue access to exploit an authorization error message rendering flaw. The flaw involves rendering an attacker-controlled queue name as HTML without proper Content Security Policy directives, enabling potential theft of the administrator's Authorization header via a CORS-permitting attacker endpoint. The issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
A missing authorization vulnerability in the drag and drop protocol of kitty versions from 0.47.0 before 0.49.0 allows a program writing to the terminal to access contents of files dragged over the window without user completion of the drop. The flaw occurs because the drop handling code serves drag data requests without verifying the drop state, enabling unauthorized file content disclosure.
A use-after-free vulnerability exists in the drag source path of the drag and drop protocol in kitty terminal versions from 0.47.0 before 0.49.0. This flaw allows a program writing to the terminal to cause the terminal process to read from and write to freed heap memory, leading to undefined behavior. The issue arises due to improper handling of pointers during error paths in drag and drop data processing functions, which can result in dereferencing freed memory without proper indication to the caller. This vulnerability is reachable from any program running in the terminal window.
A missing authorization vulnerability exists in the askpass escape code handler in kitty versions from 0.25.0 before 0.49.0. This flaw allows a local user other than the one running the terminal to capture text typed into a prompt displayed by kitty, including secrets such as passwords. The vulnerability arises because the handler does not verify ownership or permissions of a POSIX shared memory object used to exchange prompt data, enabling another local user to create a malicious shared memory object and read the victim's input. The prompt text can also overwrite warning lines due to lack of control character sanitization. Exploitation requires the attacker to cause specific bytes to be displayed by the victim's terminal. This issue does not require elevated privileges on the victim's account.
RabbitMQ versions from 4.2.0 until 4.2.8 and 4.3.2 contain a vulnerability where a successful POST /login sets an auth cookie with base64-encoded username:password credentials lacking HttpOnly, Secure, SameSite, or expiration protections. This allows attackers with certain access to recover login credentials. The issue is fixed in versions 4.2.8 and 4.3.2.
A vulnerability in kitty versions from 0.47.0 before 0.49.0 allows improper link resolution in the drag source staging path of the drag and drop protocol. This flaw enables a program writing to the terminal to create files and directories outside the intended staging directory by exploiting symlink targets that are not validated. The issue arises because the code resolves paths by constructing strings and opening directories without properly walking the directory tree, allowing creation of files and directories at arbitrary writable paths by the user running kitty.
An out-of-bounds write vulnerability exists in kitty terminal emulator versions from 0.40.0 before 0.49.0. The flaw occurs in the natural width branch of the text sizing protocol when processing OSC 66 escape codes with grapheme clusters longer than four codepoints, causing writes beyond a fixed-size buffer. This can lead to termination of the kitty process and all its windows, tabs, and child processes.
A use-after-free vulnerability exists in QEMU's 9pfs subsystem due to a race condition between threads handling concurrent Tlcreate and Twalk requests. This flaw allows a malicious guest user to bypass directory traversal restrictions and escape the shared directory boundary, potentially leading to arbitrary host file read/write and code execution on the host as the QEMU process user.
A vulnerability exists in the VMware datastore driver of OpenStack glance_store where an authenticated attacker can supply a crafted image location URI pointing to an external server. The _retry_request function does not validate the destination host before attaching sensitive authentication headers, potentially exposing these credentials. This issue affects multiple specific Ubuntu package versions of glance. The CVSS 3.1 score is 8.1, indicating a high severity impact on confidentiality and integrity but no impact on availability.
A vulnerability in kitty terminal versions from 0.14.3-1 through 0.48.2-1.1ubuntu1 allows arbitrary command execution in the user's shell. The issue arises from improper neutralization of special elements in output used by a downstream component in the colour control escape code handler. An attacker can craft a payload that is echoed back and interpreted as shell input, leading to command execution with the user's privileges.
An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client.
An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.
An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
A vulnerability in RabbitMQ server prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1 allows users with monitoring privileges to delete or restart shovel runtime parameters. This occurs because the shovel management resource improperly delegates authorization, permitting state-changing operations without proper role checks. The issue requires the rabbitmq_shovel and rabbitmq_shovel_management plugins to be enabled and valid credentials with the monitoring tag. The vulnerability is fixed in the specified versions.