Vulnerability disclosures

Security research,
responsibly disclosed

Public CVEs discovered by Cantina's autonomous AppSec agents and responsibly disclosed to affected vendors.

How Cantina finds vulnerabilities

June 24, 2026 RabbitMQ 4 public CVEs

4 new findings in RabbitMQ

2 High 2 Medium View details

Swipe severity filters · use Product and Sort to narrow results

24 results

Disclosure library

Showing 24 of 24 verified disclosures

Product / CVE Finding CVSS Severity Disclosed

June 24, 2026 4 findings

RabbitMQ CVE-2026-57218 OAuth consumers retain access after token expiry CWE-863 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 4.9 Medium June 24, 2026 RabbitMQ CVE-2026-57217 Topic permissions fail open during metadata errors CWE-755 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 7.0 High June 24, 2026 RabbitMQ CVE-2026-57216 Proxy handling bypasses loopback-only authentication CWE-290 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 6.8 Medium June 24, 2026 RabbitMQ CVE-2026-57215 Direct-reply-to bindings enable cross-tenant injection CWE-863 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 7.0 High June 24, 2026

June 18, 2026 3 findings

Node.js CVE-2026-48930 Embedded NUL bytes can silently rebind TLS authority CWE-626 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS — Medium June 18, 2026 Node.js CVE-2026-48928 Mixed-case SNI can bypass mTLS trust policies CWE-178 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS — Medium June 18, 2026 Node.js CVE-2026-48618 Unicode hostname separators bypass TLS wildcard depth CWE-295 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS — High June 18, 2026

June 1, 2026 1 finding

Nextcloud Server CVE-2026-45690 Temporary session tokens can bypass two-factor authentication CWE-287 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 5.9 Medium June 1, 2026

May 25, 2026 1 finding

Cargo CVE-2026-5223 Malicious registry crates can overwrite dependency source CWE-61 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS — Medium May 25, 2026

May 20, 2026 1 finding

Ruby CVE-2026-46727 DNS timing race can trigger a use-after-free CWE-362 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 8.1 High May 20, 2026

May 13, 2026 1 finding

urllib3 CVE-2026-44431 Cross-origin redirects can forward sensitive headers CWE-200 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 5.3 Medium May 13, 2026

May 12, 2026 1 finding

WebKit CVE-2026-43660 Thirteen-year WebKit flaw bypasses Content Security Policy CWE-693 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 7.5 High May 12, 2026

May 11, 2026 2 findings

WebKit CVE-2026-28958 WebKit data-protection flaw exposes sensitive user data CWE-200 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 5.5 Medium May 11, 2026 WebKit CVE-2026-28907 WebKit input validation bypasses Content Security Policy CWE-20 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 8.1 High May 11, 2026

May 5, 2026 1 finding

Django CVE-2026-35192 Cached public pages can expose user sessions CWE-539 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS — Medium May 5, 2026

April 22, 2026 1 finding

Spring Security CVE-2026-22753 Servlet-path matching can deactivate security controls CWE-693 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 7.5 High April 22, 2026

April 9, 2026 1 finding

wolfSSL CVE-2026-5503 ECH server-name handling writes beyond allocated memory CWE-787 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 9.1 Critical April 9, 2026

April 7, 2026 1 finding

Django CVE-2026-4292 Forged admin forms can create unauthorized model instances CWE-862 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 2.7 Low April 7, 2026

April 2, 2026 2 findings

XZ Utils CVE-2026-34743 Empty-index decoding can trigger heap buffer overflow CWE-122 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 5.3 Medium April 2, 2026 swift-crypto CVE-2026-28815 Short X-Wing keys trigger an out-of-bounds read CWE-125 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 7.5 High April 2, 2026

March 27, 2026 2 findings

Spring AI CVE-2026-22743 Filter keys enable Cypher injection in Neo4j stores CWE-89 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 7.5 High March 27, 2026 Spring AI CVE-2026-22738 User-controlled filter keys enable SpEL code execution CWE-917 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 9.8 Critical March 27, 2026

March 20, 2026 1 finding

Claude Code CVE-2026-33068 Repository settings can skip the workspace trust prompt CWE-807 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 8.8 High March 20, 2026

February 19, 2026 1 finding

OpenClaw CVE-2026-26325 Command mismatch can bypass execution approval CWE-284 Agent-discovered, human-verified, and coordinated with the affected maintainer. CVSS 7.2 High February 19, 2026

See what Cantina's autonomous AppSec agents find in your environment

Move from exploit path to a human-verified finding your team can act on.

See Cantina in action

Security research,responsibly disclosed

4 new findings in RabbitMQ

Disclosure library

See what Cantina's autonomous AppSec agents find in your environment

Security research,
responsibly disclosed