Skip to content
OpenAdvisories

Vendor

emqx

7 known vulnerabilities.

Products

MQTTX 2 emqx 2 neuron 2 CocoaMQTT 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-126495

    MQTTX through 1.13.3 Stored XSS via Topic Tree and JSON Tree Tooltips

    MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subsc…

    emqx MQTTX
  • Medium 6.6
    CVE-2026-44725

    EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution

    EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow…

    emqx emqx
  • Medium 5.7
    CVE-2026-30867

    CocoaMQTT: Denial of Service via Reachable Assertion in `PUBLISH` Packet Parsing

    CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a vulnerability exists in the packet parsing logic of CocoaMQTT that allows an attacker (or a compromised/malicious MQTT broker) to remotely crash the host iOS/…

    emqx CocoaMQTT CocoaMQTT SwiftURL
  • Medium 6.1
    CVE-2025-62413

    MQTTX vulnerable to cross-site scripting via improper message payload rendering

    MQTTX is an MQTT 5.0 desktop client and MQTT testing tool. A Cross-Site Scripting (XSS) vulnerability was introduced in MQTTX v1.12.0 due to improper handling of MQTT message payload rendering. Malicious payloads containing HTML or JavaScript could be rendere…

    emqx MQTTX
  • Medium 4.3
    CVE-2024-10965

    emqx neuron JSON File schema information disclosure

    A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v2/schema of the component JSON File Handler. The manipulation leads to information disclosure. The at…

    emqx neuron
  • Medium 6.3
    CVE-2024-10964

    emqx neuron plugin_handle.c handle_add_plugin buffer overflow

    A vulnerability classified as critical has been found in emqx neuron up to 2.10.0. Affected is the function handle_add_plugin in the library cmd.library of the file plugins/restful/plugin_handle.c. The manipulation leads to buffer overflow. It is possible to …

    emqx neuron