CVE-2026-84700 Pika Unauthenticated Replication Access via Internal Protobuf Port

PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...

EUVD-2026-69791

PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...

CVE-2026-84700

PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g., 11221 for the default 9221) that lacks authentication for non-MetaSync messages. The root cause is that the frame dispatcher (DealMessage ) does not require a completed o...

CVE-2026-84700 Pika Unauthenticated Replication Access via Internal Protobuf Port

PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...

CVE-2026-84700 Pika Unauthenticated Replication Access via Internal Protobuf Port

PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...

CVE-2026-84700: Missing Authentication for Critical Function

PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...

PT-2026-84579

PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...

CVE-2026-33606

A flaw was found in Dovecot. A malicious user can craft specific mail content that, when an administrator later uses the dsync tool with the stream protocol, is interpreted as dsync commands. This command injection allows the user to modify the state of mailboxes on the destination, including...

AlmaLinux 9 : mysql:8.4 (ALSA-2026:56973)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:56973 advisory. mysql: Performance Schema unspecified vulnerability CPU Jul 2026 CVE-2026-61081 mysql: Optimizer unspecified vulnerability CPU Jul 2026 CVE-2026-47064...

CVE-2026-84372: Improper Neutralization of CRLF Sequences

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write by splitting it with...

MiracleLinux 8 : mysql:8.4 (AXSA:2026-1695:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1695:01 advisory. mysql: Performance Schema unspecified vulnerability CPU Jul 2026 CVE-2026-61081 mysql: Optimizer unspecified vulnerability CPU Jul 2026 CVE-2026-470...

CVE-2026-82266

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with adminapirequireauth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...

CVE-2026-33606

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, includi...

CVE-2026-82266: Missing Authentication for Critical Function

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with adminapirequireauth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...

CVE-2026-6471

A flaw was found in PostgreSQL. Missing authorization in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server. Mitigation To mitigate this...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093649)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093649 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are 5.7.33 and prior and...

PT-2026-82276

『A vulnerability that causes guest OS credentials used for Application Aware processing to be recorded in cleartext in logs on the guest machine.』 CVE-2026-58070 Severity: Medium KB4902: Vulnerability Resolved in Veeam Backup & Replication 13.1 https://t.co/FR1ctYoEZc...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-061553)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-061553 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Replication. Supported versions that are affected are 5.7.36 and prior and 8.0.27 and...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093665)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093665 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Replication. Supported versions that are affected are 5.7.32 and prior and 8.0.22 and...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104749)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104749 advisory. Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account...