CVE-2026-92560Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoderCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-92550Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoderCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-92564Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processingCVSSUnrated–Not in KEV0.5%EPSS0articles
CVE-2026-92608Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10CVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-92609Apache Qpid Broker-J: Missing HTTP-session renewal after successful authenticationCVSS9.8Critical–Not in KEV0.4%EPSS1article
CVE-2026-92573Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON renderingCVSS6.5Medium–Not in KEV0.4%EPSS0articles
How these numbers are made
CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.
CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.
Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.
Product names are grouped by normalised names, with version and edition tails removed.
Fix listed refers to an advisory. Unknown fix status is counted as not listed.