PT-2026-34053

Name of the Vulnerable Software and Affected Versions mailcow: dockerized versions prior to 2026-03b Description The admin dashboard Autodiscover logs fail to perform HTML escaping on the EMailAddress value, which is logged as the user field. An unauthenticated attacker can submit a crafted...

Security update for roundcubemail (important)

openSUSE Security Update: Security update for roundcubemail Announcement ID: openSUSE-SU-2026:0141-1 Rating: important References: 1261157 1261488 Cross-References: CVE-2026-35537 Affected Products: openSUSE Backports SLE-15-SP7 An update that solves one vulnerability and has one errata is now...

📄 dmonitor 1.0.3 Server-Side Request Forgery

dmonitor version 1.0.3 suffers from an unauthenticated server-side request forgery vulnerability that can allow for data exfiltration. Exploit Title: dmonitor v1.0.3 - Unauthenticated SSRF Date: 2026-04-18 Exploit Author: Chokri Hammedi Vendor Homepage: https://github.com/dhjz/dmonitor Software...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: linkerd2, rancher, tigera-operator, cert-manager-istio-csr, gitlab-runner, cilium, k9s, kwok, juicefs-csi-driver, kots, sonobuoy, falcoctl, vcluster, kargo, gitlab-kas, zarf, cloudnative-pg, cilium-cli, percona-server-mongodb-operator, dynamic-localpv-provisioner,...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: linkerd2, rancher, tigera-operator, cert-manager-istio-csr, gitlab-runner, cilium, k9s, kwok, juicefs-csi-driver, kots, sonobuoy, falcoctl, vcluster, kargo, gitlab-kas, zarf, cloudnative-pg, cilium-cli, percona-server-mongodb-operator, dynamic-localpv-provisioner,...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: valkey: valkey-9.0.3-1.2.hum1 aarch64, x8664 valkey-compat-redis-9.0.3-1.2.hum1 noarch valkey-compat-redis-devel-9.0.3-1.2.hum1 noarch valkey-devel-9.0.3-1.2.hum1 aarch64, x8664...

Ubuntu: Security Advisory (USN-8169-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2026-35172

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared dige...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Redis, Lua vulnerabilities (USN-8169-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8169-1 advisory. It was discovered that Redis incorrectly handled certain specially crafted Lua scripts. A remote attacker...

USN-8169-1 redis, lua5.1, lua-cjson, lua-bitop vulnerabilities

It was discovered that Redis incorrectly handled certain specially crafted Lua scripts. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue was only addressed in lua5.1 on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. CVE-2025-49844 It was...

USN-8169-1: Redis, Lua vulnerabilities

It was discovered that Redis incorrectly handled certain specially crafted Lua scripts. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue was only addressed in lua5.1 on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. CVE-2025-49844 It was...

CLSA-2026-1776078299 redis: Fix of CVE-2023-41056

CVE-2023-41056: fix possible corruption in sdsResize due to incorrect allocalreadyoptimal logic skipping sds type header update...

redis: use-after-free in unblock client flow may allow remote code execution

A flaw was found in Redis. The unblock client flow does not handle an error return from the processCommandAndResetClient when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can cause a use-after-free issue. This potentially leads to...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: ctop, flux, juicefs-csi-driver, opa-envoy, dapr, harbor, logstash-exporter, fscrypt, docker-machine-driver-harvester, aws-node-termination-handler, pulumi-language-yaml, oras, spiffe-helper, smokescreen, git-lfs, witness, crossplane-provider-azure-managedidentity,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose-fips, rabbitmq-default-user-credential-updater-fips, kubernetes-csi-driver-nfs-fips, terraform-provider-kubernetes, dex-k8s-authenticator, nri-mssql, oauth2-proxy-fips, crossplane-provider-gitlab-fips, commercial-chainloop-backend, libnvidia-containe...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: nri-mssql, kubernetes-dashboard-api, gatekeeper, timestamp-authority-fips, opa-envoy, virt-controller, bank-vaults, gosu-fips, ginkgo, neuvector, kcp, nats-top-fips, knative-kafka-broker, external-secrets-operator, chisel, aws-iam-authenticator-fips,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: aws-flb-firehose-fips, rabbitmq-default-user-credential-updater-fips, kubernetes-csi-driver-nfs-fips, terraform-provider-kubernetes, dex-k8s-authenticator, nri-mssql, oauth2-proxy-fips, crossplane-provider-gitlab-fips, smarter-device-manager-fips,...

CLSA-2026-1775836571 redis: Fix of CVE-2023-41056

CVE-2023-41056: fix possible corruption in sdsResize...

Security Bulletin: Vulnerabilities in Jetty, Eclipse Jetty,Spring Cloud Netflix Zuul,Spring Framework,Spring Security,NPM package,glob-parent package,jQuery,Braces, go-redis,qs,LZ4,js-yaml might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Jetty, Eclipse Jetty, Spring Cloud Netflix Zuul , Spring Framework, Spring Security, NPM package, glob-parent package, jQuery, Braces, go-redis, qs, LZ4 and js-yaml. Vulnerabilities include , bypassing the...

RLSA-2026:6388 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For...