CVE-2026-46582: Improperly Implemented Security Check for Standard

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolvin...

PT-2026-63377

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.7.0 through 1.25.1 Description Insufficient validation of the RRSIG.Labels field and premature cache writes during RFC 8198 aggressive NSEC processing enable cache poisoning. An attacker controlling a single...

Plone 4.3 < 5.2.7 Reflected XSS and Open Redirect (HF 20220128)

The version of Plone installed on the remote host is 4.3 prior to 5.2.7. It is, therefore, affected by a reflected cross-site scripting XSS and open redirect vulnerability exists in 'Products.ATContentTypes'. An unauthenticated, remote attacker can get a compromised version of the...

Debian dsa-6395 : bind9 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6395 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6395-1 [email protected] https://www.debian.org/securit...

PT-2026-63417

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description An attacker can respond ...

CVE-2026-11721: Improper Validation of Specified Quantity in Input

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For...

unbound -- multiple vulnerabilities

NLnet Labs reports: This release consolidates security fixes for issues reported over a period of time. There are fixes for: CVE-2026-14586: Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments. CVE-2026-32665: Remote DNS-over-QUIC denial of service due to...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2763)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section...

EulerOS Virtualization 2.10.1 : unbound (EulerOS-SA-2026-2841)

According to the versions of the unbound packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead ...

EulerOS Virtualization 2.10.0 : unbound (EulerOS-SA-2026-2872)

According to the versions of the unbound packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead ...

io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records

A flaw was found in Netty's DnsResolveContext. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing...

Exploit for CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC...

BIT-DRUPAL-2026-55806 Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0., from 0.0.0 to 11.1...

OESA-2026-3078 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming reque...

OESA-2026-3077 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming reque...

OESA-2026-3074 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: This issue was discovered in version 6.0, before 6.0.5, and before 5.2.14. If the session has not been modified, the cookie's response header does not change, but...

OESA-2026-3076 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming reque...

OESA-2026-3045 varnish security update

This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x,...

WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE

This module chains two WordPress core vulnerabilities, together known as WP2Shell, to gain unauthenticated remote code execution against default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2. CVE-2026-60137 is an SQL injection in...

CVE-2026-10846

A flaw was found in ldns. When applications use ldns as a resolver over User Datagram Protocol UDP, it fails to properly match the query's destination address and port with the response's source address and port. Additionally, the query ID and question are not matched with the response. This...