PT-2026-109228

Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-109219

Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Redis 5.0.7 Lua Sandbox Escape

Redis version 5.0.7 as packaged by Debian and Ubuntu leaves the Lua package global accessible, allowing EVAL scripts to load Lua's io module and execute host commands. The supplied environment and proof of concept demonstrate CVE-2022-0543. https://packetstorm.news/download/234982...

Exploit for Missing Authorization in Redis

Redis Lua Sandbox Escape CVE-2022-0543 Vulhubhttps://vul...

CVE-2026-53713

A flaw was found in Envoy Gateway. An authenticated attacker with permissions to submit Lua extension policies can bypass file path restrictions by submitting paths containing redundant slashes. This flaw allows the attacker to read arbitrary files from the gateway controller container, resulting...

CVE-2026-25589-25588-25243-23631-23479-REDIS

GUIDE TO CHECKING & REMEDIATING 5 REDIS CVEs AS OF 2026.05.08 Release date: 2026-05-08 Author: TonyCao [email protected] Source: Redis Security Advisory TABLE OF CONTENTS 1. Overview 2. Affected Versions 3. Details of Each CVE CVE-2026-23479 — Use-after-free in Unblock Client Flow...

CVE-2026-107334

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-107334 Incorrect Authorization in Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-107334 Incorrect Authorization in Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-107334 Incorrect Authorization in Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-107334

The Malcolm software contains an Incorrect Authorization vulnerability in its nginx Lua role-based access control (RBAC) layer. The issue arises because the Lua RBAC layer performs pattern-matching on the raw, percent-encoded request URI , while Nginx selects location blocks using the percent-dec...

CVE-2026-107333 Incorrect Authorization in Malcolm

Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control RBAC authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions...

Wireshark 1.4.x < 1.4.9 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.4.9. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.4.9 advisory. - Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service application crash via...

PT-2026-108103

Name of the Vulnerable Software and Affected Versions Malcolm affected versions not specified Description The nginx Lua role-based access control RBAC layer fails to percent-decode the request URI before performing pattern-matching to restrict access to sensitive paths. While the RBAC gate...

CVE-2026-107334: Incorrect Authorization

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. Versions 8.2.1 and earlier allow an authenticated user to use a specially crafted Lua script to cause an integer overflow, potentially leading to remote code execution. This issue exists in all versions of Redis that support...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. By exploiting vulnerabilities in the Lua script execution environment, an attacker with access to Redis prior to versions 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. T...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. Prior to versions 6.2.7 and 7.0.0, an attacker who attempted to load a specially crafted Lua script could cause a NULL pointer dereference, resulting in a crash of the redis-server process. This issue was fixed in Redis versions 7.0.0 and...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. In affected versions, specially crafted Lua scripts executed in Redis can cause the heap-based Lua stack to overflow, due to incomplete checks for this condition. This can lead to heap corruption and potentially remote code...

Cisco ASA Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2019-15992)

A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating...