CVE-2026-40872: Improper Neutralization of Input During Web Page Generation

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value logged as the "user" field without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted...

📄 dmonitor 1.0.3 Server-Side Request Forgery

dmonitor version 1.0.3 suffers from an unauthenticated server-side request forgery vulnerability that can allow for data exfiltration. Exploit Title: dmonitor v1.0.3 - Unauthenticated SSRF Date: 2026-04-18 Exploit Author: Chokri Hammedi Vendor Homepage: https://github.com/dhjz/dmonitor Software...

Security update for roundcubemail (important)

openSUSE Security Update: Security update for roundcubemail Announcement ID: openSUSE-SU-2026:0141-1 Rating: important References: 1261157 1261488 Cross-References: CVE-2026-35537 Affected Products: openSUSE Backports SLE-15-SP7 An update that solves one vulnerability and has one errata is now...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: kubescape, k8sgpt-operator, trivy-operator, kiali, jitsucom-bulker, istio, kubeflow-pipelines, linkerd2, k8ssandra-client, cluster-api, k3s, kpt, velero, percona-server-mongodb-operator, k8sgpt, datadog-agent, trivy, gitlab-runner, dynamic-localpv-provisioner, zarf,...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: kubescape, k8sgpt-operator, trivy-operator, kiali, jitsucom-bulker, istio, kubeflow-pipelines, linkerd2, k8ssandra-client, cluster-api, k3s, kpt, velero, percona-server-mongodb-operator, k8sgpt, datadog-agent, trivy, gitlab-runner, dynamic-localpv-provisioner, zarf,...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: valkey: valkey-9.0.3-1.2.hum1 aarch64, x8664 valkey-compat-redis-9.0.3-1.2.hum1 noarch valkey-compat-redis-devel-9.0.3-1.2.hum1 noarch valkey-devel-9.0.3-1.2.hum1 aarch64, x8664...

Ubuntu: Security Advisory (USN-8169-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2026-35172

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared dige...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Redis, Lua vulnerabilities (USN-8169-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8169-1 advisory. It was discovered that Redis incorrectly handled certain specially crafted Lua scripts. A remote attacker...

USN-8169-1: Redis, Lua vulnerabilities

It was discovered that Redis incorrectly handled certain specially crafted Lua scripts. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue was only addressed in lua5.1 on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. CVE-2025-49844 It was...

USN-8169-1 redis, lua5.1, lua-cjson, lua-bitop vulnerabilities

It was discovered that Redis incorrectly handled certain specially crafted Lua scripts. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue was only addressed in lua5.1 on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. CVE-2025-49844 It was...

CLSA-2026-1776078299 redis: Fix of CVE-2023-41056

CVE-2023-41056: fix possible corruption in sdsResize due to incorrect allocalreadyoptimal logic skipping sds type header update...

redis: use-after-free in unblock client flow may allow remote code execution

A flaw was found in Redis. The unblock client flow does not handle an error return from the processCommandAndResetClient when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can cause a use-after-free issue. This potentially leads to...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: flannel, trivy-operator, custom-pod-autoscaler-operator, nri-elasticsearch, ipfs-cluster, stakater-reloader, cluster-autoscaler, grafana-rollout-operator, argo-events, grafana, kafkaexporter, doppler-kubernetes-operator, hubble-ui, caddy, mongo-tools,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: nri-nginx-fips, podman-fips, aws-load-balancer-controller, rancher-webhook-fips, cloudnative-pg-fips, witness, ytt, pgtimetable, telegraf, crossplane-provider-aws-ecs, nri-f5, kyverno, nuclei, backup-restore-operator-fips, cert-manager-csi-driver, commercial-grafana,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: pgtimetable, backup-restore-operator-fips, cert-manager-csi-driver, kube-state-metrics, pgpool2exporter, helm-exporter, prometheus-snmp-exporter, nfpm, json-exporter-fips, velero-plugin-for-microsoft-azure-fips, nats-top, plugin-barman-cloud-fips,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: nri-nginx-fips, podman-fips, aws-load-balancer-controller, rancher-webhook-fips, cloudnative-pg-fips, witness, ytt, pgtimetable, telegraf, crossplane-provider-aws-ecs, nri-f5, kyverno, nuclei, backup-restore-operator-fips, cert-manager-csi-driver, commercial-grafana,...

CLSA-2026-1775836571 redis: Fix of CVE-2023-41056

CVE-2023-41056: fix possible corruption in sdsResize...

Security Bulletin: Vulnerabilities in Jetty, Eclipse Jetty,Spring Cloud Netflix Zuul,Spring Framework,Spring Security,NPM package,glob-parent package,jQuery,Braces, go-redis,qs,LZ4,js-yaml might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Jetty, Eclipse Jetty, Spring Cloud Netflix Zuul , Spring Framework, Spring Security, NPM package, glob-parent package, jQuery, Braces, go-redis, qs, LZ4 and js-yaml. Vulnerabilities include , bypassing the...

RLSA-2026:6388 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For...