CVE-2026-56000

Overview

X.Org
xorg-x11-server
xorg-x11-server

08 Jul 2026

Published

08 Jul 2026

Updated

CVSS v4.0

CRITICAL (9.0)

EPSS

0.22%

MITRE

KEV

Description

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.

Statistics

1 Post
5 Interactions

Last activity: 7 hours ago

Fediverse

XLibre @XLibreDev

We released the #XLibre Xserver 25.0.0.25, 25.1.9, and beta 25.2.2 during the last 4 days containing #security fixes for #CVE-2026-55999 and CVE-2026-56000. We recommend everyone update ASAP.

https://github.com/X11Libre/xserver/releases/tag/xlibre-xserver-25.0.0.25
https://github.com/X11Libre/xserver/releases/tag/xlibre-xserver-25.1.9
https://github.com/X11Libre/xserver/releases/tag/xlibre-xserver-25.2.2

3
2
0
7h ago

CVE-2026-55999

Overview

X.Org
xorg-server
xorg-server

08 Jul 2026

Published

09 Jul 2026

Updated

CVSS v3.1

HIGH (8.5)

EPSS

0.27%

MITRE

KEV

Description

Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.

Statistics

1 Post
5 Interactions

Last activity: 7 hours ago

Fediverse

XLibre @XLibreDev

We released the #XLibre Xserver 25.0.0.25, 25.1.9, and beta 25.2.2 during the last 4 days containing #security fixes for #CVE-2026-55999 and CVE-2026-56000. We recommend everyone update ASAP.

https://github.com/X11Libre/xserver/releases/tag/xlibre-xserver-25.0.0.25
https://github.com/X11Libre/xserver/releases/tag/xlibre-xserver-25.1.9
https://github.com/X11Libre/xserver/releases/tag/xlibre-xserver-25.2.2

3
2
0
7h ago

CVE-2026-52686

Overview

PowerDNS
Recursor
pdns-recursor

23 Jul 2026

Published

23 Jul 2026

Updated

CVSS v3.1

LOW (3.7)

EPSS

0.11%

MITRE

KEV

Description

The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.

Statistics

1 Post

Last activity: 17 hours ago

Bluesky

ohhara @shiojiri.com

PowerDNS Recursorの脆弱性情報が公開されました（CVE-2026-52688、 CVE-2026-52686） https://jprs.jp/tech/security/2026-07-27-powerdns-recursor.html

0
0
0
17h ago

CVE-2026-52688

Overview

PowerDNS
Recursor
pdns-recursor

23 Jul 2026

Published

23 Jul 2026

Updated

CVSS v3.1

HIGH (7.5)

EPSS

0.13%

MITRE

KEV

Description

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

Statistics

1 Post

Last activity: 17 hours ago

Bluesky

ohhara @shiojiri.com

PowerDNS Recursorの脆弱性情報が公開されました（CVE-2026-52688、 CVE-2026-52686） https://jprs.jp/tech/security/2026-07-27-powerdns-recursor.html

0
0
0
17h ago

CVE-2026-25243

Overview

redis
redis

05 May 2026

Published

16 Jul 2026

Updated

CVSS v4.0

HIGH (7.7)

EPSS

3.30%

MITRE

KEV

Description

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

Statistics

1 Post

Last activity: 10 hours ago

Fediverse

Daily CyberSecurity @DailyCyberSecurity

Discover how new Redis RCE exploit PoC code bypasses fixes for CVE-2026-25243 and CVE-2026-25589 across multiple Redis versions.

#Redis #Cybersecurity #RCE #Vulnerability #ExploitPoC

https://meterpreter.org/redis-rce-exploit-poc/?utm_source=mastodon&utm_medium=jetpack_social

0
0
0
10h ago

CVE-2026-25589

Overview

RedisBloom
RedisBloom

05 May 2026

Published

05 May 2026

Updated

CVSS v4.0

HIGH (7.7)

EPSS

1.38%

MITRE

KEV

Description

RedisBloom is a probabilistic data structures module for Redis. In all versions of RedisBloom before 2.8.20, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisBloom module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This issue is fixed in version 2.8.20.

Statistics

1 Post

Last activity: 10 hours ago

Fediverse

Daily CyberSecurity @DailyCyberSecurity

Discover how new Redis RCE exploit PoC code bypasses fixes for CVE-2026-25243 and CVE-2026-25589 across multiple Redis versions.

#Redis #Cybersecurity #RCE #Vulnerability #ExploitPoC

https://meterpreter.org/redis-rce-exploit-poc/?utm_source=mastodon&utm_medium=jetpack_social

0
0
0
10h ago