CVE-2026-25768

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

LavinMQ is a high-performance message queue & streaming server. Before 2.6.6, an authenticated user could access metadata in the broker they should not have access to. This vulnerability is fixed in 2.6.6.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Feb 12, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-257699.1Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote CoCVE-2026-257710.0The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does notCVE-2026-257707.2Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to versionCVE-2026-257717.5Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.3.0 and prior to versionCVE-2026-257727.2Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to versionCVE-2026-257736.5** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements CVE-2026-257745.3Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-257759.8A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be performed without autheCVE-2026-257769.3Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl scriptCVE-2026-257787.5The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the CVE-2026-257796.1Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.CVE-2026-25784.3Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members