Security Vulnerabilities
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.
CVSS Score
7.5
EPSS Score
0.0
Published
2026-02-23
A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition.
CVSS Score
7.4
EPSS Score
0.0
Published
2026-02-23
libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.
CVSS Score
5.5
EPSS Score
0.0
Published
2026-02-23
libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.
CVSS Score
7.3
EPSS Score
0.0
Published
2026-02-23
libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
CVSS Score
5.0
EPSS Score
0.0
Published
2026-02-23
saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c.
CVSS Score
4.0
EPSS Score
0.0
Published
2026-02-23
Stored Cross-Site Scripting (XSS) was found in the /admin/edit_user.php page of Society Management System Portal V1.0, which allows remote attackers to inject and store arbitrary JavaScript code that is executed in users' browsers. This vulnerability can be exploited via the name parameter in a POST HTTP request, leading to execution of malicious scripts when the affected content is viewed by other users, including administrators.
CVSS Score
6.1
EPSS Score
0.0
Published
2026-02-23
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a sensitive information exposure vulnerability in the configuration download functionality. The configuration download response includes the router password and administrative password in plaintext. The endpoint also omits appropriate Cache-Control directives, which can allow the response to be stored in client-side caches and recovered by other local users or processes with access to cached browser data.
CVSS Score
6.5
EPSS Score
0.0
Published
2026-02-23
An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.
CVSS Score
6.5
EPSS Score
0.0
Published
2026-02-23
Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an authenticated administrator to access or retrieve unauthorized internal information in rare conditions.
CVSS Score
5.5
EPSS Score
0.0
Published
2026-02-23