PT-2026-82088

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.11.0 through 3.17.0 Description An issue exists where the attach-consumer-label plugin fails to correctly sanitize certain input values. This allows an attacker to perform an authorization bypass or escalate privileges...

CVE-2026-63041: Reliance on Untrusted Inputs in a Security Decision

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...

"Am I Just That Dumb?": Applicability, Action and Verification in Consumer IoT Security Advice

Public campaigns urge people to change default passwords on Internet of Things IoT devices and keep them updated, assuming users can independently determine whether the advice applies. We gave 28 participants in the Netherlands two pieces of government-issued advice reflecting guidance in several...

Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

EUVD-2026-64958

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

CVE-2026-66907 Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

PT-2026-80002

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-19709

The Membership For WooCommerce WordPress plugin (versions before 3.1.2 ) is vulnerable to an unauthenticated member data disclosure. The root cause is a failure to verify if an API consumer secret has actually been generated before comparing it against a value supplied in a request. On sites wher...

CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

SUSE SLES15 Security Update : redis7 (SUSE-SU-2026:3636-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3636-1 advisory. This update for redis7 fixes the following issue: - CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending...

Linux Distros Unpatched Vulnerability : CVE-2026-63639

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload th...

SUSE SLES15 Security Update : redis (SUSE-SU-2026:3638-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3638-1 advisory. This update for redis fixes the following issue: - CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending...

SUSE SLES15 Security Update : redis7 (SUSE-SU-2026:3639-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3639-1 advisory. This update for redis7 fixes the following issue: - CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending...

SUSE SLES15 Security Update : redis (SUSE-SU-2026:3637-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3637-1 advisory. This update for redis fixes the following issue: - CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending...

org.jenkins-ci.plugins:rabbitmq-build-trigger (>=1.0, <=1.1), org.jenkins-ci.plugins:rabbitmq-consumer (>=1.0, <=1.1) potentially affected by CVE-2026-61634 via com.rabbitmq:amqp-client (3.0.3)

com.rabbitmq:amqp-client MAVEN version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.jenkins-ci.plugins:rabbitmq-build-trigger =1.0, =1.0, =1.1 Source cves: CVE-2026-61634 Source advisory:...

org.apache.camel:camel-rabbitmq (>=2.13.0, <=2.13.4), org.axonframework:axon-amqp (2.1) +3 more potentially affected by CVE-2026-61634 via com.rabbitmq:amqp-client (3.2.2)

com.rabbitmq:amqp-client MAVEN version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.apache.camel:camel-rabbitmq =2.13.0, =2.1, =2.1, =2.6 Source cves: CVE-2026-61634 Source advisory:...

org.jenkins-ci.plugins:rabbitmq-build-trigger (>=1.0, <=1.1), org.jenkins-ci.plugins:rabbitmq-consumer (>=1.0, <=1.1) potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.0.3)

com.rabbitmq:amqp-client MAVEN version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.jenkins-ci.plugins:rabbitmq-build-trigger =1.0, =1.0, =1.1 Source cves: CVE-2026-63336 Source advisory:...

org.jenkins-ci.plugins:rabbitmq-build-trigger (>=1.0, <=1.1), org.jenkins-ci.plugins:rabbitmq-consumer (>=1.0, <=1.1) potentially affected by CVE-2026-63335 via com.rabbitmq:amqp-client (3.0.3)

com.rabbitmq:amqp-client MAVEN version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.jenkins-ci.plugins:rabbitmq-build-trigger =1.0, =1.0, =1.1 Source cves: CVE-2026-63335 Source advisory:...