CVE-2026-95699

CriticalCVSS 9.6/10Last modified Sep 25, 2026

Description

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

Weakness enumeration

CWE-653

Affected software

No affected versions have been published.

Timeline

Published: Sep 24, 2026
Last modified: Sep 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-95707.1The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a fron CVE-2026-957015.1In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checkin CVE-2026-957028.5Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard cont CVE-2026-957035.1In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MI CVE-2026-957047.2A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to CVE-2026-957057.2Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to pe CVE-2026-957067.2Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to pe CVE-2026-957077.2A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve r CVE-2026-957087.2Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high priv CVE-2026-957097.2Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high priv CVE-2026-95716.5Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deacti CVE-2026-957107.1An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthentic