CVE-2026-95699Critical· 9.6▾ MidnightPrior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' dev…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115517Medium· 6.4Unrestricted network access between execution contexts in KNIME Business Hub
CVE-2026-115416High· 7.7Incorrect authorization checks in Amazon Athena engine version 3 query processing
CVE-2026-114087High· 8.1Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets
CVE-2026-109441Medium· 5.8LangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker Bridge
CVE-2026-109443High· 8.8JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell
CVE-2026-98466High· 8.2kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)