CVE-2026-85432High· 8.2▾ TwilightMOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attacke…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55210High· 7.4Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)
CVE-2026-63329Medium· 4.9Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux
CVE-2026-62987Medium· 5.8Fabio is an HTTP(S) and TCP router for deploying applications managed by consul
CVE-2026-85751Critical· 9.8Mailu is a mail server distributed as a set of Docker images
CVE-2026-69183High· 7.5Monkeytype is a minimalistic and customizable typing test
CVE-2026-61682Critical· 9.9kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads