Threats affecting pkg:generic/mosquitto

CVE-2026-129456 is a use-after-free vulnerability in FRRouting's bgpd component involving the Tunnel Encapsulation attribute (type 23). A BGP neighbor can send crafted UPDATE messages that cause reference count imbalances, leading to freed memory being accessed and freed again. This results in bgpd aborting and dropping all BGP sessions. The issue requires an established BGP session and is triggered when "soft-reconfiguration inbound" is configured. The vulnerability affects versions 10.4.0 through before 10.4.4 and 10.5.0 through before 10.5.4. Fixed versions 10.4.4 and 10.5.4 are available.

The Multi Step for Contact Form 7 WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'multipart field name (array key)' parameter in all versions up to and including 2.9.1. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires the 'Save every step' option enabled on the target form and the Database for Contact Form 7 companion plugin active with its 'Expandable' table option enabled, both disabled by default.

The BuddyForms plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'buddyforms_form_content' parameter in all versions up to and including 2.10.6. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. Exploitation requires a form configured with the public_submit option, which is enabled by default in the plugin's bundled Post Simple template. The vulnerability has a medium severity rating with a CVSS score of 5.4.

The Lightbox & Modal Popup WordPress Plugin (FooBox) versions up to and including 2.8.7 are vulnerable to stored DOM-based cross-site scripting (XSS) via the 'img alt attribute inside .wp-caption container' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Exploitation requires subscriber-level access if bbPress 2.6.20 is installed with a public forum and approved topics, or contributor-level access otherwise.

The FV Player 8 WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the 'fv_player_videos' parameter affecting all versions up to and including 8.1.9. This flaw allows authenticated users with subscriber-level access or higher to inject malicious scripts into pages, which execute when viewed by others. Exploitation requires the 'Allow visitors to upload videos to their profile' setting to be enabled, as this setting controls access to the vulnerable save functionality.

Kroki versions before 0.36.0 have a reflected cross-site scripting (XSS) vulnerability in the /dbml/svg endpoint. This flaw allows unauthenticated attackers to inject JavaScript via crafted DBML table URL, header color, or TableGroup color parameters. When a user opens the crafted SVG link and clicks the table header, the injected JavaScript executes in the context of the Kroki origin.

The gateio-ws package on PyPI contains malicious code that executes during installation by overriding the install command in setup.py. This package is part of a campaign involving typosquatting and is designed to exfiltrate environment variables and other data, raising significant privacy and security concerns.

The PyPI package demo-pingtest-xyz version 0.0.1 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It appears to be a low-risk package resembling pentest or testing tools but with unauthorized data exfiltration functionality.

The gateio-sdk package on PyPI contains malicious code that executes during installation by overriding the install command in setup.py. This package is part of a campaign involving typosquatting and is designed to exfiltrate environment variables and other data, raising serious privacy and security concerns.

CVE-2026-129267 is a cross-site scripting (XSS) vulnerability in sergix44 XBackBone versions 3.8.0, 3.8.1, and 3.8.2. The flaw exists in the MediaController::getRawById function within app/Controllers/MediaController.php. This vulnerability allows remote attackers to inject malicious scripts. Public exploit code is available, but a fix is pending acceptance of a pull request.

CVE-2026-129264 is an out-of-bounds write vulnerability in the sox_ng software affecting versions 14.8.0 and 14.8.1. The flaw exists in the read_samples_voc function within the VOC Decoder component. This vulnerability can be exploited remotely and has publicly disclosed exploit code. A patch identified by commit 0b40408b has been released to fix the issue.

CVE-2026-129262 is a vulnerability in Wuxi Wubang Security Software's Wubang Five-in-One Safety Production Management Information System up to version 3.5. It involves an unrestricted file upload issue in the DiyFileUpload function of the /ws.asmx file. This flaw allows remote attackers to upload files without restriction. Public exploit code is available, and the vendor has not responded to disclosure attempts. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.

CVE-2026-129261 is a critical vulnerability in Kingston FURY CTRL RGB Control Software up to version 2.0.19. It involves an exposed IOCTL interface in the NTIOLib_X64.sys driver component that lacks sufficient access control. This flaw allows a local attacker with high privileges to manipulate the IOCTL interface, potentially leading to severe system compromise. The vulnerability requires local access and high privileges to exploit.

CVE-2026-129260 is a path traversal vulnerability in Mereithhh VanBlog versions up to 0.54.0. It affects the fs.readFileSync function in the local.provider.ts file of the Custom Page Handler component. This vulnerability allows remote attackers to manipulate the file path argument, potentially accessing unauthorized files. A public exploit has been disclosed. Upgrading to version test-20261013 resolves the issue.