CVE-2026-6564

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the component Session Handling. The manipulation results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-266 CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Apr 19, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-656408.8WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Pr CVE-2026-656419.3A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.CVE-2026-656428.6Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and CVE-2026-656438.8Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.CVE-2026-656447.5Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/live CVE-2026-656454.3Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList an CVE-2026-656469.9Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose ar CVE-2026-656478.7Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.CVE-2026-65656.4The Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress is vulnerable to Stored Cross CVE-2026-656504.3Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.CVE-2026-656518.7temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree witho CVE-2026-656528.7github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can