🔓 CVEs & KEV
CVE-2026-94606 — goauthentik authentik — CVSS 8.9 — authentik: MFA Bypass via State Confusion / Parameter Injection in Authentica...
CVE-2026-67410 — rabbitmq rabbitmq-server — CVSS 8.2 — RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoin...
CVE-2026-67419 — rabbitmq rabbitmq-server — CVSS 7.1 — RabbitMQ: Consecutive topic wildcards cause combinatorial routing workRabbitM...
CVE-2026-67408 — rabbitmq rabbitmq-server — CVSS 7.1 — RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-P...
CVE-2026-67226 — rabbitmq rabbitmq-server — CVSS 6.9 — RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags listRabbitMQ is a m...
CVE-2026-67411 — rabbitmq rabbitmq-server — CVSS 6.0 — RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permissi...
CVE-2026-67413 — rabbitmq rabbitmq-server — CVSS 6.0 — RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker ...
📋 ADVISORIES
- 📄 Source for CISA adds actively exploited WSO2 and Adobe Commerce flaws to KEV catalog — cisa.gov