CVE-2026-36590 | High | 7.5 | 2026-07-15 | An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component |
CVE-2026-8741 | Low | 3.1 | 2026-05-17 | A vulnerability has been found in EMQX up to 6.2.0. This affects an unknown function of the file apps/emqx/src/emqx_persistent_session_ds.erl of the component… |
CVE-2026-32135 | High | 7.5 | 2026-04-20 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the `uri_pa… |
CVE-2026-34608 | Medium | 4.9 | 2026-04-02 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inproc.c, the hook_work_cb() function proce… |
CVE-2026-30867 | Medium | 5.7 | 2026-04-02 | CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a vulnerability exists in the packet parsing logic of CocoaM… |
CVE-2026-32696 | Low | 3.1 | 2026-03-30 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In NanoMQ version 0.24.6, after enabling auth.http_auth (HTTP authentication), when a cli… |
CVE-2026-25627 | Medium | 6.5 | 2026-03-30 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSocket transport can be crashed by sending… |
CVE-2026-21888 | High | 7.5 | 2026-03-11 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() accepts 5-byte var… |
CVE-2026-22040 | Medium | 5.3 | 2026-03-04 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffic pattern of high-frequency publishes a… |
CVE-2025-68699 | Medium | 6.5 | 2026-02-04 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, NanoMQ has a protocol parsing / forwarding inconsistency when handling… |
CVE-2024-48077 | High | 7.5 | 2026-01-15 | NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. A crafted sequence of requests causes the recv-q queue to saturate… |
CVE-2025-66023 | Medium | 4.9 | 2026-01-01 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.5 have a Heap-Use-After-Free (UAF) vulnerability within the MQTT b… |
CVE-2025-59946 | High | 7.5 | 2025-12-27 | NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. Prior to version 0.24.2, there is a classical data racing issue about sub info list which could resu… |
CVE-2025-59947 | Critical | 9.0 | 2025-12-15 | NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger both shared subscri… |
CVE-2025-62413 | Medium | 6.1 | 2025-10-16 | MQTTX is an MQTT 5.0 desktop client and MQTT testing tool. A Cross-Site Scripting (XSS) vulnerability was introduced in MQTTX v1.12.0 due to improper handling… |
CVE-2025-52136 | Low | 3.0 | 2025-08-10 | In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is that this is the int… |
CVE-2024-42655 | High | 8.8 | 2025-07-29 | An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard char… |
CVE-2024-42651 | High | 7.5 | 2025-07-29 | NanoMQ v0.17.9 was discovered to contain a heap use-after-free vulnerability via the component sub_Ctx_handle. This vulnerability allows attackers to cause a D… |
CVE-2024-42650 | High | 7.5 | 2025-07-15 | NanoMQ 0.17.5 was discovered to contain a segmentation fault via the component /nanomq/pub_handler.c. This vulnerability allows attackers to cause a Denial of… |
CVE-2024-42649 | Medium | 6.5 | 2025-07-14 | NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message. |
CVE-2024-42648 | Medium | 6.5 | 2025-07-14 | NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service (DoS) via a crafted CONNECT message. |
CVE-2024-42646 | High | 7.5 | 2025-07-14 | A segmentation fault in NanoMQ v0.21.10 allows attackers to cause a Denial of Service (DoS) via crafted messages. |
CVE-2024-10965 | Medium | 4.3 | 2024-11-07 | A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v2… |
CVE-2024-10964 | Medium | 6.3 | 2024-11-07 | A vulnerability classified as critical has been found in emqx neuron up to 2.10.0. Affected is the function handle_add_plugin in the library cmd.library of the… |
CVE-2024-44460 | High | 7.5 | 2024-09-12 | An invalid read size in Nanomq v0.21.9 allows attackers to cause a Denial of Service (DoS). |
CVE-2024-31036 | Medium | 6.8 | 2024-04-22 | A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of service via transmission of crafted hex… |
CVE-2024-31041 | High | 7.5 | 2024-04-17 | Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to cause a denial of service. |
CVE-2024-31040 | Low | 2.7 | 2024-04-17 | Buffer Overflow vulnerability in the get_var_integer function in mqtt_parser.c in NanoMQ 0.21.7 allows remote attackers to cause a denial of service via a seri… |
CVE-2024-25767 | Medium | 6.5 | 2024-02-26 | nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c. |
CVE-2023-37781 | Medium | 6.5 | 2023-07-17 | An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted .txt file. |
CVE-2023-34494 | High | 7.5 | 2023-06-12 | NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c. |
CVE-2023-34488 | High | 7.8 | 2023-06-12 | NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes malformed messages. |
CVE-2023-33657 | High | 7.5 | 2023-06-08 | A use-after-free vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_mqtt_msg_get_publish_property() in the f… |
CVE-2023-33660 | High | 7.5 | 2023-06-08 | A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function copyn_str() in the file mqtt_parser.c… |
CVE-2023-33658 | High | 7.5 | 2023-06-08 | A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_msg_get_pub_pid() in the file mess… |
CVE-2023-33659 | High | 7.5 | 2023-06-06 | A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nmq_subinfo_decode() in the file mqtt_… |
CVE-2023-33656 | Medium | 5.5 | 2023-05-30 | A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker could exploit this vulnerability to cause… |
CVE-2023-29996 | High | 7.5 | 2023-05-04 | In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and unsubinfo_decode. |
CVE-2023-29995 | High | 7.5 | 2023-05-04 | In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c |
CVE-2023-29994 | High | 7.5 | 2023-05-04 | In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c. |
CVE-2021-46434 | Medium | 5.3 | 2022-03-28 | EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the application returns different results depen… |
CVE-2021-33175 | High | 7.5 | 2021-06-08 | EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted… |