BIT-RABBITMQ-2026-66076 RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, isauthorized/2 calls rabbitmgmtutil:isauthorized/2, which checks only the management tag, instead of isauthorizedvhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost...

Rocky Linux 9 [CIQ] Security Update: redis / redis-debuginfo / redis-debugsource / redis-devel / etc Multiple Vulnerabilities (crlsa-2026_65120)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202665120 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 redis: Redis: Denial of Service via Out-of-Bounds Read in Cluster...

The vulnerability in the `framework/wazuh/core/cluster/common.py` file of the security monitoring and threat detection platform used by Wazuh allows a perpetrator to trigger a service failure.

The vulnerability in the framework/wazuh/core/cluster/common.py file of the Wazuh security monitoring and threat detection platform is related to unlimited resource distribution. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

PT-2026-105607

OpenShift Cluster Logging Operator missing authorization flaw in github.com/openshift/cluster-logging-operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

Security update for valkey (important)

openSUSE security update: security update for valkey ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21985-1 Rating: important References: bsc1281417 Cross-References: CVE-2026-92925 CVSS scores: CVE-2026-92925 SUSE : 7.1...

CVE-2026-102136

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be...

CVE-2026-102141

Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a...

CVE-2026-102120

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in ...

CVE-2026-102108

An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account...

OPENSUSE-SU-2026:21985-1 Security update for valkey

This update for valkey fixes the following issue: - CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet parser can lead to an out-of-bounds read bsc1281417...

CVE-2026-102108 Kiteworks Email Protection Gateway deserialization of untrusted data

An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account...

CVE-2026-102108

The Kiteworks Email Protection Gateway is vulnerable to a deserialization of untrusted data flaw. An authenticated administrator with specific queue-management privileges could submit a crafted serialized object to a cluster management interface . Due to insufficient validation during deserializa...

EUVD-2026-90311

An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account...

CVE-2026-102108 Kiteworks Email Protection Gateway deserialization of untrusted data

An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account...

SUSE-SU-2026:23986-1 Security update for valkey

This update for valkey fixes the following issue: - CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet parser can lead to an out-of-bounds read bsc1281417...

EUVD-2026-90299

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in ...

CVE-2026-102120 Kiteworks Core OS Command Injection

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in ...

CVE-2026-102120

A privilege escalation vulnerability exists in Kiteworks due to insufficient input validation within an internal cluster management function. This flaw allows an attacker who already has code execution on one node of a clustered Kiteworks deployment to execute operating system commands with eleva...

CVE-2026-102120 Kiteworks Core OS Command Injection

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in ...

CVE-2026-102135

The Kiteworks Email Protection Gateway is vulnerable to code execution via deserialization of untrusted data on clusters with database replication enabled. A trusted party can submit a crafted serialized object that is processed without sufficient validation, potentially allowing execution as the...