CVE-2026-100527 OpenClaw before 2026.8.2 Denial of Service via Browser Relay

OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions...

PT-2026-99164

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.2 Description A denial of service issue exists in the Browser extension relay. Unauthenticated network sources can exhaust the pending-authentication capacity by maintaining silent WebSocket upgrades. This...

CVE-2026-65828 Zammad: Pending upload deletion bypass via legacy attachment endpoint

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroyform action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied formid without verifying that the requesting user owns those records. An authenticated...

CVE-2026-65828 Zammad: Pending upload deletion bypass via legacy attachment endpoint

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the legacy destroyform action on AttachmentsController deletes UploadCache Store records based solely on a user-supplied formid without verifying that the requesting user owns those records. An authenticated...

PT-2026-98462

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Multipath TCP MPTCP implementation where incorrect accounting occurs within the mptcp subflow push pending function. If the subflow push pending function returns a...

CVE-2026-95845

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or...

PT-2026-97396

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description Moquette does not enforce a maximum length for pending per-session message queues. This allows queued messages to accumulate without bound in memory or persistent storage when a fast publisher send...

Important: Red Hat Security Advisory: redis security update

An update for redis is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 9 : redis (RHSA-2026:69861)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69861 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

RHEL 9 : redis (RHSA-2026:69862)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69862 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

CVE-2026-59815 Joplin: Pending share recipients can write items into shared folders before accepting invitations

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. ...

SUSE SLES15 Security Update : redis7 (SUSE-SU-2026:3991-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3991-1 advisory. This update for redis7 fixes the following issue: - CVE-2026-81934: TLS pending-data handling can cause use-after-free bsc1277794. Tenable h...

SUSE SLES15 Security Update : redis (SUSE-SU-2026:4068-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4068-1 advisory. This update for redis fixes the following issue: - CVE-2026-81934: TLS pending-data handling can cause use-after-free bsc1277794. Tenable ha...

RHEL 8 : redis:6 (RHSA-2026:69542)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69542 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

RHEL 8 : redis:6 (RHSA-2026:69534)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69534 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

SUSE SLES15 Security Update : redis (SUSE-SU-2026:3990-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3990-1 advisory. This update for redis fixes the following issue: - CVE-2026-81934: TLS pending-data handling can cause use-after-free bsc1277794. Tenable ha...

RHEL 8 : redis:6 (RHSA-2026:69533)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69533 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

SUSE SLES15 Security Update : redis7 (SUSE-SU-2026:4069-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4069-1 advisory. This update for redis7 fixes the following issue: - CVE-2026-81934: TLS pending-data handling can cause use-after-free bsc1277794. Tenable h...

WordPress Core <= 7.1 - Contributor+ Draft and Pending Post Slug Disclosure vulnerability

Contributor+ Draft and Pending Post Slug Disclosure vulnerability discovered by hermanhms in WordPress core versions = 7.1...

PT-2026-94624

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the md/md-llbitmap component where the llbitmap destroy function deletes the pending timer before flushing the md llbitmap io wq workqueue. Because daemon work may sti...