Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Redis vulnerabilities (USN-8866-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8866-1 advisory. It was discovered that Redis did not properly manage memory when handling the TLS pending-data list. A remote attacker could...

USN-8866-1: Redis vulnerabilities

It was discovered that Redis did not properly manage memory when handling the TLS pending-data list. A remote attacker could possibly use this issue to execute arbitrary code. CVE-2026-81934 It was discovered that Redis incorrectly handled certain inputs when processing cluster bus packets. A...

USN-8866-1 redis vulnerabilities

It was discovered that Redis did not properly manage memory when handling the TLS pending-data list. A remote attacker could possibly use this issue to execute arbitrary code. CVE-2026-81934 It was discovered that Redis incorrectly handled certain inputs when processing cluster bus packets. A...

Important: Red Hat Security Advisory: redis security update

An update for redis is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 9 : redis (RHSA-2026:69862)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69862 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

RHEL 8 : redis:6 (RHSA-2026:69533)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69533 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

RHEL 8 : redis:6 (RHSA-2026:69542)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69542 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

MiracleLinux 9 : redis-6.2.24-1.el9_8 (AXSA:2026-1829:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1829:03 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 redis: Redis: Arbitrary code execution via TLS pending-data...

redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free

A flaw was found in Redis. This vulnerability, a use-after-free, exists within the tlsProcessPendingData function, which manages the Transport Layer Security TLS pending-data list when Redis is configured with TLS support. A remote, unauthenticated attacker could exploit this to execute...

CVE-2026-78364 MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

EUVD-2026-54924

A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

CVE-2026-19356

A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

CVE-2026-19356

MingSoft MCMS (up to 3.0.6) is affected in the ms-mdiy component, specifically via an issue in the /mdiy/form/data/list path. The vulnerability enables information disclosure and is exploitable remotely. Public exploits are noted in the sources. The vendor was contacted about the disclosure but d...

PT-2026-69297

Name of the Vulnerable Software and Affected Versions MingSoft MCMS versions prior to 3.0.7 Description A remote information disclosure issue exists within the ms-mdiy component. The flaw is located in an unknown function of the '/mdiy/form/data/list' endpoint, allowing a remote attacker to...

CVE-2026-19356: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

CVE-2026-50032

CVE-2026-50032: A NULL pointer dereference in the MMS Write Named Variable List handler of libIEC61850 (MMS write service) can crash the server when an empty listOfData is sent. Affected in libIEC61850 up to v1.6.1; fix status: patched in v1.6.2 (bd338f23). The issue is a DoS condition exploitabl...

CVE-2026-47378

CVE-2026-47378 concerns NocoDB, where before 2026.04.1 public shared-view endpoints could expose hidden-column values through three paths: (1) groupBy could return raw values for any column named in the request, (2) filter and sort arrays operated on hidden columns allowed boolean-blind extractio...

CVE-2026-47378: Authorization Bypass Through User-Controlled Key

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on...

CVE-2026-31481

In the Linux kernel, the following vulnerability has been resolved: tracing: Drain deferred trigger frees if kthread creation fails Boot-time trigger registration can fail before the trigger-data cleanup kthread exists. Deferring those frees until late init is fine, but the post-boot fallback mus...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992941)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992941 advisory. In the Linux kernel, the following vulnerability has been resolved: hwmon: ibmpex Fix possible UAF when ibmpexregisterbmc fails Smatch report warning as follows:...