CVE-2026-66373High· 7.5▾ TwilightRedis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.9%
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94370High· 8.1A defect in the Qt for MCUs core string handling causes heap memory corruption
CVE-2026-107886Low· 2.3OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management
CVE-2026-80775High· 7.0kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
CVE-2026-98823Medium· 5.3kernel: wifi: cfg80211: preserve hidden-group beacon IE ownership (CVE-2026-98823)
CVE-2026-98834Medium· 4.1kernel: mtd: core: avoid double-free of OTP NVMEM device (CVE-2026-98834)
CVE-2026-98855Medium· 4.4kernel: of/overlay: put property on deadprops only after changeset add succeeds (CVE-2026-98855)