EUVD-2026-95156

Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider...

Rocky Linux 10 [CIQ] Security Update: glibc / glibc-all-langpacks / glibc-benchtests / etc Multiple Vulnerabilities (crlsa-2026_19061)

The Rocky Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619061 advisory. glibc: glibc: Incorrect DNS response parsing via crafted DNS server response CVE-2026-4437 glibc: glibc: Invalid DNS hostname returned via gethostbyaddr...

Rocky Linux 9.6 [TuxCare] Security Update: compat-libpthread-nonshared / glibc / glibc-all-langpacks / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1776176227)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776176227 advisory. - Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C...

CVE-2026-100373

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

CVE-2026-68558 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

PT-2026-60951

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.2.6 SurrealDB versions prior to 2.3.6 SurrealDB versions prior to 2.1.8 SurrealDB versions prior to 3.0.0-alpha.8 Description An authenticated user can bypass network access restrictions in http:: functions. The...

RockyLinux 9 : glibc (RLSA-2026:20597)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:20597 advisory. glibc: glibc: Incorrect DNS response parsing via crafted DNS server response CVE-2026-4437 glibc: glibc: Invalid DNS hostname returned via gethostbyaddr...

RockyLinux 10 : glibc (RLSA-2026:19061)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19061 advisory. glibc: glibc: Incorrect DNS response parsing via crafted DNS server response CVE-2026-4437 glibc: glibc: Invalid DNS hostname returned via gethostbyadd...

AZL-80282 CVE-2026-4438 affecting package glibc for versions less than 2.38-19

Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification...

CVE-2026-4438

Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification...

Linux Distros Unpatched Vulnerability : CVE-2026-4438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2....