Threats affecting pkg:generic/mosquitto

The Swipe WordPress plugin versions up to 1.4 contain an authentication bypass vulnerability that allows unauthenticated attackers to obtain WordPress session cookies without proper login verification. This flaw enables attackers to log in as any existing user, including administrators, if that user has an active app session.

The Duplicate Post WordPress plugin versions before 1.5.8 contain a missing authorization vulnerability. This flaw allows users with roles granted access to the plugin, such as Contributors, to publish posts without proper permission checks. As a result, these users can create published posts, including posts attributed to other users, which they normally should not be able to do.

The Duplicate Post WordPress plugin versions before 1.5.8 contain an authorization flaw where users with roles granted access to the plugin, such as Contributor, can duplicate posts without verifying edit permissions. When the slug takeover option is enabled, this allows such users to move any readable post off its original permalink and publish their copy at that address.

The Duplicate Post WordPress plugin versions before 1.5.8 have a missing authorization check when saving global settings. This flaw allows users with any role granted access by an administrator, including low-privilege roles such as Subscriber, to overwrite global settings, including the role-access list itself.

A missing authorization vulnerability in the Flatsome WordPress theme before version 3.20.13 allows users with the Contributor role to publish their own content and change its post type via an AJAX save action without having the necessary permissions.

A vulnerability in the Flatsome WordPress theme before version 3.20.13 allows unauthenticated users to access unpublished post content via an AJAX action that lacks proper capability or nonce checks. This exposure includes draft and pending posts, potentially leaking sensitive information.

The Chargely Free Subscriptions For Woocommernce WordPress plugin version 1.0 and earlier exposes sensitive configuration data via an unauthenticated REST API route. This flaw allows attackers to retrieve the live WooCommerce REST API consumer key and secret, which provide full read and write access to the store.

The Email Marketing 4Dem WordPress plugin versions up to 2.0.5 contain a missing authorization vulnerability. This flaw allows unauthenticated users to invoke certain AJAX actions without capability checks, enabling them to delete stored configurations and records.

The Email Marketing 4Dem WordPress plugin up to version 2.0.5 lacks proper authorization checks on multiple AJAX actions and REST API routes. This flaw allows unauthenticated users to access and disclose stored plugin configuration and data, as well as modify the plugin's stored settings.

The Countdown, Coming Soon, Maintenance WordPress plugin up to version 3.0.8 has a vulnerability where it does not verify user permissions before returning post titles via an AJAX action. This allows any authenticated user, including subscribers, to view the titles of published posts of any post type, even those normally restricted by WordPress. However, draft, private, and pending posts are not disclosed.

The Countdown, Coming Soon, Maintenance WordPress plugin up to version 3.0.8 contains a cross-site scripting (XSS) vulnerability. This occurs because the plugin does not perform authorization or nonce checks when saving countdown data on post save, and its output sanitization allowlist permits script tags. As a result, users with Author-level access or higher can inject arbitrary scripts that execute when the affected content is viewed on the front end or in an administrator session.

The Optimole WordPress plugin up to version 4.2.19 contains a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server due to insufficient file path validation. Exploitation requires the presence of PEAR's Archive_Tar library and an administrator to perform a rename action on an attachment after the attacker stages a malicious payload in a comment. This can lead to remote code execution if critical files like wp-config.php are deleted.

A critical authorization bypass vulnerability exists in the AutomatorWP Pro plugin for WordPress, specifically in the webhook addon, affecting all versions up to and including 1.4.4. This flaw allows unauthenticated attackers to reset passwords of any WordPress user account, including administrators, leading to full account takeover. Exploitation requires a specific plugin configuration involving a Receive Webhook trigger paired with an Update-User action with certain fields left blank or mapped to the webhook password tag.

This entry references internally found bugs fixed in Firefox ESR 153.1 and Firefox 154, but the provided data pertains to a Microsoft vulnerability (CVE-2026-74988) with minimal details. The description does not detail the nature of the vulnerability or its impact. No patch or remediation information is provided, and no active exploitation is reported.

This entry references internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1, and Firefox 154, but the provided data pertains to a Microsoft vulnerability (CVE-2026-74987) with minimal details. The description does not detail the nature of the vulnerability or its impact. No patch or remediation information is provided.

A site isolation issue has been identified in the CSS Parsing and Computation component of Microsoft software version 4.0. The vulnerability is catalogued as CVE-2026-74986 and is associated with CWE-200, indicating an information exposure weakness. No CVSS score or detailed impact information is provided, and there are no known exploits in the wild. No patch or remediation details are currently available.

CVE-2026-74985 is a privilege escalation vulnerability in the Enterprise Policies component of Microsoft software version 4.0. The vulnerability allows an attacker to gain elevated privileges, potentially impacting system security. No CVSS score or detailed technical information is provided. There is no indication of active exploitation in the wild or available patches at this time.

A vulnerability identified as CVE-2026-74983 affects the Data Loss Prevention component in Microsoft software version 4.0. The issue involves a mitigation bypass, classified under CWE-693. No CVSS score or detailed technical impact information is provided. There is no indication of known exploitation in the wild or available patches at this time.

A denial-of-service vulnerability has been identified in the Widget component of Microsoft software version 4.0. The vulnerability is publicly known but lacks detailed technical information and a CVSS score. No exploits are reported in the wild, and no patch or remediation details are provided.

A site isolation issue has been identified in the Audio/Video: Web Codecs component of Microsoft software version 4.0. The vulnerability is documented under CVE-2026-74981. No detailed technical information, impact, or exploit status is provided beyond its publication date.