https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-02T11:08:50.099059+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-67239 CVE-2026-67239 — RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI 2026-11-02T11:08:50.102890+00:00

Affected: rabbitmq-server

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI (sibling of V-11). lines 102/106/110 render peercertsubject / peercertissuer with raw <%= %> and no fmtstring(). RFC4514 backslash-escaping of </> is HTML-inert and bypassable (<img ... //>). Requires non-default config: a stream TLS listener with verifypeer and an attacker-obtainable trusted cert with a malicious Same as the connection.ejs finding, against operators viewing the stream-connection detail rabbitmqstream + rabbitmqstreammanagement enabled with a TLS listener using verifypeer Attacker can obtain a certificate signed by a CA the listener trusts, with attacker-chosen DN An operator views the. This issue is fixed in versions 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3.

 https://db.gcve.eu/vuln/usn-8933-1 USN-8933-1 — rabbitmq-server vulnerabilities 2026-11-02T11:08:50.102988+00:00

Affected: Ubuntu:Pro:16.04:LTS: rabbitmq-server, Ubuntu:Pro:18.04:LTS: rabbitmq-server, Ubuntu:Pro:20.04:LTS: rabbitmq-server, Ubuntu:22.04:LTS: rabbitmq-server, Ubuntu:24.04:LTS: rabbitmq-server, Ubuntu:26.04:LTS: rabbitmq-server

It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration. An attacker could possibly use this issue to cause a cross-site request forgery attack. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-66070)

It was discovered that RabbitMQ Server incorrectly handled TLS peer-certificate DNs in the management UI. An attacker could possibly use this issue to cause a cross-site scripting attack. (CVE-2026-66077)

It was discovered that RabbitMQ Server incorrectly handled AMQP 1.0 arrays with zero-width element constructors. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-66079)

It was discovered that RabbitMQ Server trust-store plugin incorrectly validated client certificates. An attacker could possibly use this issue to bypass TLS client authentication. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67231)

It was discovered that RabbitMQ Server incorrectly handled WebSocket frame sizes. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67232)

It was discovered that RabbitMQ Server incorrectly handled content-header body…