CVE-2026-68553

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

CVE-2026-75854

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75854 ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75854

ArcadeDB versions before 26.8.1 expose a missing authentication flaw in the Redis wire-protocol plugin. Network attackers can connect to the Redis port with no credentials and read, write, or delete data across any server database, scoring CVSS 9.8 (CRITICAL). No exploitation evidence is provided...

EUVD-2026-60615

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

BIT-DISTRIBUTION-2026-35172 Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared dige...

GHSA-J6GC-4893-QWMP New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

Summary Authenticated users can repeatedly call PUT /api/user/self with language or sidebarmodules while relay requests are consuming quota. The settings path reads a full User snapshot and writes it back through User.Update, which refreshes Redis with RedisHSetObj and overwrites the Quota field...

New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

Summary Authenticated users can repeatedly call PUT /api/user/self with language or sidebarmodules while relay requests are consuming quota. The settings path reads a full User snapshot and writes it back through User.Update, which refreshes Redis with RedisHSetObj and overwrites the Quota field...

CVE-2026-64865

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebarmodules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a...

CVE-2026-64865

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebarmodules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a...

CVE-2026-64865

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebarmodules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a...

EUVD-2026-60263

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebarmodules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a...

CVE-2026-64865 New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebarmodules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a...

CVE-2026-64865 New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebarmodules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: redis (UTSA-2026-100781)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100781 advisory. Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-monolith, kubernetes-replicator, crossplane-provider-aws-connect-fips, k6, headlamp-fips, chisel, spire-controller-manager, prometheus-redis-exporter, argo-rollouts-fips, lvm-driver-fips, vault-fips, conftest, kbld, argocd-image-updater-fips,...

CVE-2026-73651 vulnerabilities

Vulnerabilities for packages: redisinsight...

SpEL Injection

Spring Data KeyValue / Spring Data Redis is vulnerable to SpEL Injection. The vulnerability is due to unsanitized Sort input being evaluated by SpelPropertyComparator, allowing an attacker to inject and execute malicious SpEL expressions...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: aactl, minio, mc, src, telegraf, terraform, terraform-provider-pagerduty, thanos-operator, xeol, flux-image-automation-controller, cert-manager-cmctl, flux-notification-controller, croc, conftest, dask-gateway, kubeflow-katib, redka, hubble, goreleaser, nerdctl,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nri-rabbitmq, opa, pluto, cis-operator, aws-privateca-issuer, grafana-rollout-operator, ini-file, argo-events, kor, gobuster, timescaledb-tune, nri-apache, clickhouse-operator, guac, dive, emissary, ko, grafana-alloy, terraform-provider-azapi, spire-controller-manage...