Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
33 results
Aug 20, 2026EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles.CVE-2026-44725 · Other software · emqx · reported by GitHubMedium 6.6
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.
- Product
- emqx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c componentCVE-2026-36590 · Other software · Emqx · reported by MITREHigh 7.5
An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2026A vulnerability has been found in EMQX up to 6.2.0.CVE-2026-8741 · Other software · Emqx · reported by VulDBLow 1.3
A vulnerability has been found in EMQX up to 6.2.0. This affects an unknown function of the file apps/emqx/src/emqx_persistent_session_ds.erl of the component QoS 2 PUBLISH Packet Handler. Such manipulation leads to race condition. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
- Product
- Emqx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetCVE-2026-33356 · Other software · Meari · reported by 44488dab-36db-4358-99f9-bc116477f914High 7.7
In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.
- Product
- IoT Cloud MQTT Broker EMQX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2026A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0.CVE-2026-6564 · Other software · EMQ · reported by VulDBLow 2.1
A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the component Session Handling. The manipulation results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EMQX Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift.CVE-2026-30867 · Other software · emqx · reported by GitHubMedium 5.7
CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a vulnerability exists in the packet parsing logic of CocoaMQTT that allows an attacker (or a compromised/malicious MQTT broker) to remotely crash the host iOS/macOS/tvOS application. If an attacker publishes the 4-byte malformed payload to a shared topic with the RETAIN flag set to true, the MQTT broker will persist the payload. Any time a vulnerable client connects and subscribes to that topic, the broker will automatically push the malformed packet. The app will instantly crash in the background before the user can even interact with it. This effectively "bricks" the mobile application (a persistent DoS) until the retained message is manually wiped from the broker database. This issue has been patched in version 2.2.2.
- Product
- CocoaMQTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling.CVE-2024-48077 · Other software · Emqx · reported by MITREHigh 7.5
NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. A crafted sequence of requests causes the recv-q queue to saturate, leading to the rapid exhaustion of system file descriptors (FDs). This exhaustion triggers a process crash, rendering the broker unable to provide services.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 16, 2025MQTTX is an MQTT 5.0 desktop client and MQTT testing tool.CVE-2025-62413 · Other software · emqx · reported by GitHubMedium 6.1
MQTTX is an MQTT 5.0 desktop client and MQTT testing tool. A Cross-Site Scripting (XSS) vulnerability was introduced in MQTTX v1.12.0 due to improper handling of MQTT message payload rendering. Malicious payloads containing HTML or JavaScript could be rendered directly in the MQTTX message viewer. If exploited, this could allow attackers to execute arbitrary scripts in the context of the application UI — for example, attempting to access MQTT connection credentials or trigger unintended actions through script injection. This vulnerability is especially relevant when MQTTX is used with brokers in untrusted or multi-tenant environments, where message content cannot be fully controlled. This vulnerability is fixed in 1.12.1.
- Product
- MQTTX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface.CVE-2025-52136 · Other software · EMQX · reported by MITRELow 3
In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is that this is the intended behavior; however, 5.8.6 adds a defense-in-depth feature in which a plugin's acceptability (for later Dashboard installation) is set by the "emqx ctl plugins allow" CLI command.
- Product
- EMQX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.emqx.comdocs.emqx.com
Jul 29, 2025An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard charaCVE-2024-42655 · Other software · Emqx · reported by MITREHigh 8.8
An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard characters.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025NanoMQ v0.17.9 was discovered to contain a heap use-after-free vulnerability via the component sub_Ctx_handle.CVE-2024-42651 · Other software · Emqx · reported by MITREHigh 7.5
NanoMQ v0.17.9 was discovered to contain a heap use-after-free vulnerability via the component sub_Ctx_handle. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SUBSCRIBE message.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025NanoMQ 0.17.5 was discovered to contain a segmentation fault via the component /nanomq/pub_handler.c.CVE-2024-42650 · Other software · Emqx · reported by MITREHigh 7.5
NanoMQ 0.17.5 was discovered to contain a segmentation fault via the component /nanomq/pub_handler.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message.CVE-2024-42649 · Other software · Emqx · reported by MITREMedium 6.5
NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service (DoS) via a crafted CONNECT message.CVE-2024-42648 · Other software · Emqx · reported by MITREMedium 6.5
NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service (DoS) via a crafted CONNECT message.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A segmentation fault in NanoMQ v0.21.10 allows attackers to cause a Denial of Service (DoS) via crafted messages.CVE-2024-42646 · Other software · Emqx · reported by MITREHigh 7.5
A segmentation fault in NanoMQ v0.21.10 allows attackers to cause a Denial of Service (DoS) via crafted messages.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024A vulnerability classified as problematic was found in emqx neuron up to 2.10.0.CVE-2024-10965 · Other software · emqx · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v2/schema of the component JSON File Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The patch is named c9ce39747e0372aaa2157b2b56174914a12c06d8. It is recommended to apply a patch to fix this issue.
- Product
- neuron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024A vulnerability classified as critical has been found in emqx neuron up to 2.10.0.CVE-2024-10964 · Other software · emqx · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in emqx neuron up to 2.10.0. Affected is the function handle_add_plugin in the library cmd.library of the file plugins/restful/plugin_handle.c. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
- Product
- neuron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024An invalid read size in Nanomq v0.21.9 allows attackers to cause a Denial of Service (DoS).CVE-2024-44460 · Other software · emqx · reported by MITREHigh 7.5
An invalid read size in Nanomq v0.21.9 allows attackers to cause a Denial of Service (DoS).
- Product
- nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to cause a denial of service.CVE-2024-31041 · Other software · emqx · reported by MITREHigh 7.5
Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to cause a denial of service.
- Product
- nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024Buffer Overflow vulnerability in the get_var_integer function in mqtt_parser.c in NanoMQ 0.21.7 allows remote attackers to cause a denial of service via a serieCVE-2024-31040 · Other software · emqx · reported by MITRELow 2.7
Buffer Overflow vulnerability in the get_var_integer function in mqtt_parser.c in NanoMQ 0.21.7 allows remote attackers to cause a denial of service via a series of specially crafted hexstreams.
- Product
- nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2024nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c.CVE-2024-25767 · Other software · Emqx · reported by MITREMedium 6.5
nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted .txt file.CVE-2023-37781 · Other software · Emqx · reported by MITREMedium 6.5
An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted .txt file.
- Product
- Emqx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.CVE-2023-34494 · Other software · Emqx · reported by MITREHigh 7.5
NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes malformed messages.CVE-2023-34488 · Other software · Emqx · reported by MITREHigh 7.8
NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes malformed messages.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023A use-after-free vulnerability exists in NanoMQ 0.17.2.CVE-2023-33657 · Other software · Emqx · reported by MITREHigh 7.5
A use-after-free vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_mqtt_msg_get_publish_property() in the file mqtt_msg.c. This vulnerability is caused by improper data tracing, and an attacker could exploit it to cause a denial of service attack.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023A heap buffer overflow vulnerability exists in NanoMQ 0.17.2.CVE-2023-33660 · Other software · Emqx · reported by MITREHigh 7.5
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function copyn_str() in the file mqtt_parser.c. An attacker could exploit this vulnerability to cause a denial of service attack.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023A heap buffer overflow vulnerability exists in NanoMQ 0.17.2.CVE-2023-33658 · Other software · Emqx · reported by MITREHigh 7.5
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_msg_get_pub_pid() in the file message.c. An attacker could exploit this vulnerability to cause a denial of service attack.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023A heap buffer overflow vulnerability exists in NanoMQ 0.17.2.CVE-2023-33659 · Other software · Emqx · reported by MITREHigh 7.5
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nmq_subinfo_decode() in the file mqtt_parser.c. An attacker could exploit this vulnerability to cause a denial of service attack.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023A memory leak vulnerability exists in NanoMQ 0.17.2.CVE-2023-33656 · Other software · Emqx · reported by MITREMedium 5.5
A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker could exploit this vulnerability to cause a denial of service attack by causing the program to consume all available memory resources.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and unsubinfo_decode.CVE-2023-29996 · Other software · Emqx · reported by MITREHigh 7.5
In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and unsubinfo_decode.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.cCVE-2023-29995 · Other software · Emqx · reported by MITREHigh 7.5
In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c.CVE-2023-29994 · Other software · Emqx · reported by MITREHigh 7.5
In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface.CVE-2021-46434 · Other software · Emqx · reported by MITREMedium 5.3
EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid
- Product
- Emqx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.