PT-2026-80283

Impact What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: ../../../tmp/escape 1 - file created at /tmp/escape 1 ../../../../../../../../tmp/escape 2 - fi...

Fedora 44 : firefox (2026-fc11919789)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fc11919789 advisory. Implement buffer stride support for PipeWire camera. ---- - Update to latest upstream 154.0 - Enabled Wayland session restore on KDE. Tenable has...

CVE-2026-76614

OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestoresel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, an...

CVE-2026-76614 OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore

OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestoresel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, an...

CVE-2026-76614

OpenEMR versions before 8.3.0 contain a path traversal vulnerability in the EDI archive restore function. The archrestore_sel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the files...

CVE-2026-76614 OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore

OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestoresel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, an...

CVE-2026-74311

A flaw was found in the Linux kernel. During a system restore operation, the virtio real-time clock RTC component fails to properly manage virtual queues virtqueues. If the reinitialization of these virtqueues fails, the system attempts to delete queues using incorrect memory references. This can...

PT-2026-79990

Type confusion in PostgreSQL pg restore attribute stats allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before...

SUSE SLES15 Security Update : redis7 (SUSE-SU-2026:3636-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3636-1 advisory. This update for redis7 fixes the following issue: - CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending...

SUSE SLES15 Security Update : redis (SUSE-SU-2026:3637-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3637-1 advisory. This update for redis fixes the following issue: - CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending...

Linux Distros Unpatched Vulnerability : CVE-2026-63639

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload th...

SUSE SLES15 Security Update : redis (SUSE-SU-2026:3638-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3638-1 advisory. This update for redis fixes the following issue: - CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending...

SUSE SLES15 Security Update : redis7 (SUSE-SU-2026:3639-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3639-1 advisory. This update for redis7 fixes the following issue: - CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending...

AZL-96885 CVE-2026-63639 affecting package valkey for versions less than 8.0.10-1

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

DEBIAN-CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639

Valkey (distributed key-value DB) has a use-after-free in the RESTORE command's RDB stream consumer-group deserialization: a malformed payload assigns one Pending Entry List NACK to multiple consumers, and deleting one while another references it can lead to remote code execution (CVSS 8.8 HIGH, ...

CVE-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...