RabbitMQ server versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1 contain a vulnerability in the rabbitmq_stream plugin where an authenticated stream client with read access can cause the broker node to crash. This occurs because the get_chunk_selector/1 function calls binary_to_atom on untrusted client-supplied data without validation. The issue is fixed in the specified versions.
CVE-2026-66074 affects RabbitMQ messaging broker versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. The vulnerability arises from the match_value/3 function passing user-supplied regular expressions to re:run without a match_limit, causing excessive CPU consumption when processing large resource sets. This can lead to significant CPU exhaustion and scheduler saturation via normal API use by any user with the management tag. The issue is fixed in the specified versions.
CVE-2026-66075 affects RabbitMQ server versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1. The vulnerability allows a user with monitoring privileges to restart any federation link, a state-changing operation that disrupts message flow. This occurs because the authorization check for the /federation-links/.../restart route incorrectly uses a monitoring authorization function that permits DELETE methods without per-method elevation checks. The issue requires the rabbitmq_federation and rabbitmq_federation_management plugins to be enabled. The vulnerability is fixed in the specified versions.
CVE-2026-66077 is a cross-site scripting (XSS) vulnerability in RabbitMQ's management UI prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. The issue arises because the management UI uses EJS 1.0 templating which does not HTML-escape certain certificate subject fields. An attacker who can obtain a TLS client certificate signed by a trusted CA and with a crafted Subject DN can inject JavaScript that executes in the administrator's browser when viewing connection details. This allows full account takeover capabilities via the management UI. The vulnerability requires the TLS listener to be configured with verify_peer enabled and the attacker to have a CA-signed client certificate. A fix is available in the stated versions.
RabbitMQ versions prior to 4.1.11, 4.2.6, and 4.3.0 contain a vulnerability in the rabbitmq_stream_management plugin where the validate_partitions function does not enforce an upper bound on the requested partition count. This can lead to excessive memory allocation (around 8GB) when a large partition count is requested. The vulnerability requires the plugin to be enabled and the caller to have management tag and access to the target virtual host. The issue is fixed in versions 4.1.11, 4.2.6, and 4.3.0.
CVE-2026-67218 is a privilege escalation vulnerability in RabbitMQ server's HTTP API when the rabbitmq_stream_management plugin is enabled. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, users with management tag and vhost access but without configure permissions can create super-streams via the HTTP API due to missing permission checks. This allows creation of persistent cluster-wide resources without proper authorization. The issue is fixed in the specified versions.
RabbitMQ versions prior to 3.13.17, 4.0.22, 4.1.13, and 4.2.6 contain a vulnerability in the management plugin's CORS handling. When configured with a wildcard CORS origin, the server reflects the request's Origin header and sends Access-Control-Allow-Credentials: true, enabling a malicious web page visited by a signed-in administrator to issue authenticated requests using cached credentials. This issue is fixed in the specified versions.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost from the path without checking that the user can access it. Any management-tagged user can therefore read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible vhosts, exposing cross-tenant queue names and cluster topology. The management plugin must be enabled and the attacker must have a management tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
CVE-2026-66079 is a vulnerability in RabbitMQ server versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6. It allows an unauthenticated network attacker to crash any RabbitMQ node with the AMQP 1.0 listener enabled by sending a specially crafted ~19-byte frame. The flaw arises from improper parsing of a list element count, leading to excessive memory allocation and termination of the Erlang VM, causing denial of service. The issue is fixed in the specified versions.
CVE-2026-67238 is a vulnerability in RabbitMQ server prior to versions 4.2.7 and 4.3.1. It involves improper handling of caller-supplied ETF-encoded binaries in the rabbit_pid_codec:decompose_from_binary/1 function, which can lead to exhaustion of atoms in the Erlang VM. An authenticated AMQP client can exploit this by sending approximately one million crafted requests, causing the entire Erlang VM to crash, affecting all virtual hosts and connections. The issue is fixed in RabbitMQ versions 4.2.7 and 4.3.1.
Sulu CMS versions prior to 2.6.25 and 3.0.8 contain a vulnerability in the Smart Content QueryBuilder that allows unauthenticated attackers to manipulate category identifiers in a query parameter. This manipulation can lead to inference or enumeration of content repository nodes, including unpublished content, or submission of malformed queries that degrade availability. The vulnerability does not allow modification of repository data. Fixed in versions 2.6.25 and 3.0.8.
An out-of-bounds heap read vulnerability exists in GIMP's TIM image loader. Opening a specially crafted 4bpp TIM image that triggers promotion to an RGBA layer causes the file-tim plug-in to allocate an undersized buffer but process it as if it were larger. This can lead to adjacent heap memory being copied into the decoded image and may cause the plug-in to crash. The issue affects multiple specific versions of GIMP as listed. The CVSS score is 4.4, indicating a medium severity level.
Streamlink versions prior to 8.6.0 have a vulnerability in HTTPSession where it mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. This allows a remote server to redirect an HTTP or HTTPS URL to a local file URL, causing Streamlink to read and return local file contents. The flaw affects all requests made through HTTPSession and can lead to local file content being included in stream output. The issue is fixed in version 8.6.0.
FFmpeg versions before 9.0 contain a signed integer overflow vulnerability in the libavformat/mov.c component. The flaw arises when width and height values from a crafted HEIF ispe box exceed the maximum signed integer limit, causing these values to become negative and leading to an integer overflow during image grid processing. This overflow can bypass validity checks, potentially allowing an attacker to cause a denial of service or other impacts.
A vulnerability in the tar source plugin of Apache BuildStream running on Python versions earlier than 3.12 allows malicious source tarballs to write files on the host system via symlink attacks. This can lead to arbitrary file writes with the privileges of the user running BuildStream. The issue is mitigated by using trusted sources, SHA256 hash pinning, and improvements in BuildStream 2.3.0 when running on Python 3.12 or later. Users are advised to upgrade to BuildStream version 2.8.1, which addresses this vulnerability.
A medium severity security vulnerability (CVE-2026-95897) affects Dask up to version 2026.8.0 in the from_npy_stack function of dask/array/core.py. The vulnerability involves deserialization manipulation and can be exploited remotely. The issue was reported early but has not yet received a response from the project. Exploit details have been publicly disclosed, though no known exploits are currently active in the wild.
CVE-2026-92709 is a medium severity vulnerability affecting multiple specific versions of the rsyslog software package, primarily distributed in various Ubuntu releases. The exact nature and technical details of the vulnerability are not described in the available data. There is no CVSS score or detailed impact information provided. No patch or remediation guidance is currently available, and no known exploits in the wild have been reported.
A vulnerability in rsyslog's mdtls component causes it to discard the peer-identity verification result. This issue affects multiple specific Ubuntu package versions of rsyslog. The severity is assessed as medium. No CVSS score or detailed technical impact is provided. There is no information about available patches or exploits in the wild.
CVE-2026-95516 is a medium severity vulnerability affecting multiple specific versions of the Zbar software. The exact nature and technical details of the vulnerability are not provided. There is no CVSS score or detailed impact information available. No known exploits in the wild have been reported. The affected versions include various builds and releases of Zbar documented in the input data. No patch or remediation information is provided, so the current patch status is unknown.