Threats affecting pkg:generic/mosquitto

CVE-2026-129359 is a medium-severity vulnerability in Linux Foundation Magma up to version 1.9.0. It involves hard-coded credentials in an unspecified function within the file orc8r/lib/go/registry/interceptors.go. The flaw can be exploited remotely without authentication. Public exploit code has been released, but no vendor response or patch is currently available.

CVE-2026-129358 is a cross-site scripting (XSS) vulnerability in Linux Foundation Magma up to version 1.9.0. The flaw exists in the handleReact function within the nms/server/main/routes.ts file of the NMS component. This vulnerability allows remote attackers to inject malicious scripts. Public exploit code is available, but no vendor response or patch has been provided.

CVE-2026-129357 is a medium-severity vulnerability in Linux Foundation Magma up to version 1.9.0. It involves missing authorization in the hostOrgMiddleware function within the Host Middleware component, allowing remote attackers to manipulate the role argument. The vulnerability has been publicly disclosed with available exploit details, but no vendor response or patch is currently known.

Zr.Admin.NET contains an authorization bypass vulnerability in the GET /workflow/instance/{instanceId} endpoint that allows authenticated low-privilege users to access other users' workflow instances by enumerating sequential instance IDs. This exposure includes sensitive approval request data such as form contents, applicant details, and approval records.

CVE-2026-129455 is an authorization bypass vulnerability in Zr.Admin.NET's FrontArticleController. Authenticated users can exploit this flaw to change the visibility and pin state of articles belonging to other users by sending a crafted PUT request with their own UserId. This allows attackers to make private articles public and subsequently access them anonymously via a GET request.

CVE-2026-129464 is a path traversal vulnerability in Zr.Admin.NET that allows any authenticated user to read arbitrary files on the server via the /common/DownloadFile endpoint's path parameter. By exploiting this flaw, attackers can access sensitive configuration files such as appsettings, potentially extracting the JwtSettings SecretKey to forge administrator tokens.

CVE-2026-129465 is an authorization bypass vulnerability in Zr.Admin.NET's SysProfileController.UpdateProfile function. It allows any authenticated user to modify other users' accounts by specifying a user-controlled UserId. Exploitation enables an attacker to change the administrator's phone number to one they control, request an SMS code, and log in as the administrator, effectively taking over the account.

CVE-2026-129466 is a missing authorization vulnerability in Zr.Admin.NET affecting the TasksController.Get method. This flaw allows any authenticated user to access scheduled task details without requiring the monitor:job permission. Attackers can leverage an unprotected endpoint to enumerate task IDs and then retrieve sensitive job parameters, API URLs, cron schedules, and stored SQL statements.

CVE-2026-129356 is a race condition vulnerability in the vllm-project vllm software versions 0.30.0 and 0.31.0. It affects the Common Prefix Handler component in the file single_type_kv_cache_manager.py. The vulnerability can be exploited remotely but is considered highly complex and difficult to exploit. A public exploit exists. Upgrading to version 0.32.0 resolves the issue.

CVE-2026-129355 is a medium severity vulnerability in sigoden dufs up to version 0.46.0 affecting the WebDAV COPY Operation Handler in src/server.rs. It causes incorrect authorization, allowing remote attackers to exploit the flaw. Upgrading to version 0.47.0 mitigates the issue.

CVE-2026-129354 is a critical stack-based buffer overflow vulnerability in the D-Link DIR-600L router version 2.17b02. The flaw exists in the hnap_main function of the HNAP Handler component, allowing remote attackers to execute a buffer overflow via crafted input. Exploit code has been published, increasing the risk of exploitation.

The npm package @crvouga/mockingbird-service-microsoft version 0.14.0 contains malicious code. Any computer with this package installed or running is considered fully compromised. It is recommended to remove the package and immediately rotate all secrets and keys from a different, uncompromised machine. However, removal of the package alone may not eliminate all malicious software introduced by it.

CVE-2026-129353 is a critical stack-based buffer overflow vulnerability in the D-Link DIR-600L router firmware versions 2.17 and 2.17b02. The flaw exists in the authenticationcgi_main function of the authentication.cgi file, where manipulation of the id/password argument can trigger the overflow. This vulnerability is remotely exploitable without authentication. Public exploit code is available, increasing the risk of exploitation.

CVE-2026-129352 is a critical stack-based buffer overflow vulnerability in TRENDnet TEW-657BRM version 1.00.1. It arises from improper processing of the /usr/sbin/upgrade_flash.cgi file, allowing remote attackers to manipulate argument boundaries and cause a buffer overflow. The product has been end-of-life for over 15 years, and the vendor has not confirmed the vulnerability but plans to notify customers. Exploit code is publicly available.

CVE-2026-129351 is a critical out-of-bounds write vulnerability in the TRENDnet TEW-657BRM version 1.00.1. It affects the sprintf function in the /setup.cgi file of the mini_httpd component. The vulnerability can be exploited remotely and public exploit code has been disclosed. However, the product has been end-of-life (EOL) for over 15 years and is no longer supported by the vendor.

FRRouting's bgpd daemon improperly processes a Tunnel Encapsulation attribute (type 23) with a mismatched outer TLV length, leading to reference count imbalances and use-after-free conditions. This can cause bgpd to abort and drop all BGP sessions, requiring a restart. The vulnerability requires an established BGP session and can be triggered repeatedly by a neighbor sending crafted UPDATE messages. The issue affects both iBGP and eBGP neighbors unless the attribute is explicitly discarded. Crashes do not occur on every attempt but can be reliably reproduced with certain configurations.

The npm package 'testpackage83' version 1.0.0 contains malicious code that downloads and executes an untrusted binary from an unverified HTTP source during installation and runtime. This binary is fetched from a suspicious IPv4 address and masquerades as a patched Chromium executable. The package executes this binary via puppeteer-core, potentially allowing arbitrary code execution on the user's machine.