CVE-2025-49844

CVE-2025-49844 – Redis Lua Parser Use-After-Free Lua chunk-name GC race leading to Redis 8.2.1 use-after-free and remote code execution. Overview Redis embeds Lua 5.1 for scripting. In versions up to 8.2.1 the luaYparser function does NOT anchor the chunk name string on the Lua stack before...

CVE-2025-49844

CVE-2025-49844 – Use-After-Free Issue in Redis's Lua Parser In short and simple terms, you run this script and instead of localhost you provide the target IP and configure its port, it connects if it is vulnerable, and you can execute any command you want. In Shodan, you can also find vulnerable...

CVE-2026-75520

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, CmdUpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command...

CVE-2026-75520 Domoticz: Missing authorization and path traversal in the udevices Lua parser handler

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, CmdUpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command...

EUVD-2026-112548

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, CmdUpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command...

CVE-2026-75520 Domoticz: Missing authorization and path traversal in the udevices Lua parser handler

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, CmdUpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command...

CVE-2026-75520

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the "udevices" JSON command handler, "CmdUpdateDevices" in "main/WebServerCmds.cpp", performed no "session.rights" check before invoking a Lua parser script, while its sibling...

CVE-2026-75520

The home automation system Domoticz (prior to version 2026.3 ) contains a missing authorization and path traversal vulnerability in the udevices JSON command handler (Cmd_UpdateDevices in main/WebServerCmds.cpp). Because this handler fails to perform a session.rights check, a low-privilege authen...

CVE-2026-75520: domoticz: Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, CmdUpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command...

PT-2026-129224

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, Cmd UpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command...

Astra Linux – Vulnerability in Apache2

A carefully crafted request body can cause a buffer overflow in the modlua multipart parser r:parsebody called from Lua scripts. The Apache httpd team is not aware of an exploit for this vulnerability, but it might be possible to create one. This issue affects Apache HTTP Server 2.4.51 and earlie...

📄 ZTE ZXHN Router Denial of Service

The CGILua post.lua parser used in ZTE ZXHN routers does not enforce an upper bound on the body size of application/x-www-form-urlencoded POST requests. An unauthenticated attacker can crash or freeze the router's web management service by sending a single HTTP POST request with an oversized body...

Ubuntu 16.04 LTS : Lua vulnerability (USN-8262-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8262-1 advisory. It was discovered that the Lua parser incorrectly handled garbage collection when processing specially crafted Lua scripts. A remote attacker could possibly use...

USN-8262-1: Lua vulnerability

It was discovered that the Lua parser incorrectly handled garbage collection when processing specially crafted Lua scripts. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code...

CVE-2026-24818

CVE-2026-24818 is an out-of-bounds read vulnerability in praydog UEVR, specifically affecting the dependencies/lua/src modules (lparser.C). The issue is noted to impact UEVR before version 1.05. Multiple sources (NVD, Red Hat, OSV, CIRCL, CVE lists) describe the flaw consistently, but do not prov...

CVE-2022-35158

A vulnerability in the lua parser of TscanCode tsclua v2.15.01 allows attackers to cause a Denial of Service DoS via a crafted lua script...

PT-2025-41846

Name of the Vulnerable Software and Affected Versions YouDataSum CPAS Audit Management System versions prior to 4.9 Description The YouDataSum CPAS Audit Management System is susceptible to SQL Injection due to inadequate input validation. This allows remote, unauthenticated attackers to execute...

EUVD-2022-38052

Malicious code in bioql PyPI...

PT-2025-26588 · Unknown · Notepadnext

Name of the Vulnerable Software and Affected Versions: NotepadNext versions through v0.11 Description: The issue is an Out-of-bounds Read vulnerability in the NotepadNext Lua Parser Module, specifically affecting the singlevar function in lparser.c. This vulnerability can lead to a heap-based...

tarantool:luaL_loadbuffer_fuzzer: Index-out-of-bounds in parse_chunk

Project: https://github.com/tarantool/tarantool.git Detailed Report: https://oss-fuzz.com/testcase?key=6283570354651136 Project: tarantool Fuzzing Engine: libFuzzer Fuzz Target: luaLloadbufferfuzzer Job Type: libfuzzerubsantarantool Platform Id: linux Crash Type: Index-out-of-bounds Crash Address...