10622 matches found
No title provided
An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port...
redis: Redis: Out-of-bounds read via crafted cluster bus packets
A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...
EUVD-2026-72694
A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval GrantMethod: auto and no client secret public client. The redirect URIs are derived from the operator-created Route, whose hostname is...
EUVD-2026-72692
A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...
CVE-2026-77968
hawtio-operator grants its ServiceAccount cluster-wide Secret read and write permissions via an overbroad ClusterRole (secrets: [create, get, list, update, watch] across all namespaces). Although the operator uses a controller-runtime label-selector cache for memory optimization, the ServiceAccou...
CVE-2026-77968 Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount
A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...
[SECURITY] Fedora 44 Update: corosync-3.1.10-6.fc44
This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...
PT-2026-87161
Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An authenticated user with write privileges can trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted,...
PT-2026-87022
In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this server-side request forgery SSRF to read response...
PT-2026-87167
Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. An unauthenticated client with network access to a router port...
PT-2026-87899
Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network...
CVE-2026-72989: Use of Uninitialized Resource
Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network...
PT-2026-88510
Impact The Elasticsearch and ElasticSecurity nodes built REST endpoints by interpolating user-provided identifiers straight into the request path. A value containing path separators or dot segments changed which endpoint the request actually reached, so an operation intended for one document coul...
PT-2026-87162
Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in the query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from operations performed by other users. Th...
PT-2026-87988
🚨 HIGH: CVE-2026-78444 CVSS 8.1 Untrusted pointer dereference in Windows Failover Cluster enables remote code execution over network. No authentication required. Patch immediately. CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/JlgAg4R9uL...
CVE-2026-82068: Reachable Assertion
A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentiall...
PT-2026-87830
Name of the Vulnerable Software and Affected Versions Windows Failover Cluster affected versions not specified Description A double free issue exists in Windows Failover Cluster. A double free occurs when a program attempts to free the same memory location twice, which can lead to memory...
PT-2026-87919
Name of the Vulnerable Software and Affected Versions Windows Failover Cluster affected versions not specified Description A use after free condition exists in Windows Failover Cluster, which allows an unauthorized remote attacker to execute arbitrary code over a network and affect the system. Us...