Windows Failover Cluster Information Disclosure Vulnerability

Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network...

Windows Failover Cluster Elevation of Privilege Vulnerability

Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally...

redis: Redis: Out-of-bounds read via crafted cluster bus packets

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...

No title provided

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port...

EUVD-2026-72694

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval GrantMethod: auto and no client secret public client. The redirect URIs are derived from the operator-created Route, whose hostname is...

CVE-2026-77968

hawtio-operator grants its ServiceAccount cluster-wide Secret read and write permissions via an overbroad ClusterRole (secrets: [create, get, list, update, watch] across all namespaces). Although the operator uses a controller-runtime label-selector cache for memory optimization, the ServiceAccou...

EUVD-2026-72692

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

CVE-2026-77968 Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

[SECURITY] Fedora 44 Update: corosync-3.1.10-6.fc44

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

PT-2026-87988

🚨 HIGH: CVE-2026-78444 CVSS 8.1 Untrusted pointer dereference in Windows Failover Cluster enables remote code execution over network. No authentication required. Patch immediately. CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/JlgAg4R9uL...

PT-2026-87830

Name of the Vulnerable Software and Affected Versions Windows Failover Cluster affected versions not specified Description A double free issue exists in Windows Failover Cluster. A double free occurs when a program attempts to free the same memory location twice, which can lead to memory...

PT-2026-87919

Name of the Vulnerable Software and Affected Versions Windows Failover Cluster affected versions not specified Description A use after free condition exists in Windows Failover Cluster, which allows an unauthorized remote attacker to execute arbitrary code over a network and affect the system. Us...

PT-2026-87899

Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network...

CVE-2026-78444: Untrusted Pointer Dereference

Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker to execute code over a network...

CVE-2026-73010: Use After Free

Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network...

CVE-2026-72989: Use of Uninitialized Resource

Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network...

CVE-2026-71338: Double Free

Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally...

PT-2026-88159

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user could invoke machine learning functionality beyond their authorization scope,...

CVE-2026-82069: Improper Removal of Sensitive Information Before Storage or Transfer

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypasse...

CVE-2026-82068: Reachable Assertion

A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentiall...