CVE-2026-54845: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in MDTF = 1.3.8 versions...

CVE-2026-54844: Missing Authorization

Unauthenticated Broken Access Control in CheckView Automated Testing = 2.1.0 versions...

CVE-2026-54843: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in MDTF = 1.3.7 versions...

CVE-2026-54841: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Vitepos = 3.4.2 versions...

CVE-2026-54830: Missing Authorization

Unauthenticated Broken Access Control in Five Star Restaurant Reservations = 2.7.19 versions...

CVE-2026-54828: Missing Authorization

Unauthenticated Broken Access Control in Motors = 1.4.109 versions...

CVE-2026-54823: Improper Control of Generation of Code

Contributor Remote Code Execution RCE in Widget Options = 4.2.3 versions...

CVE-2026-42390: Improper Input Validation

An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation...

CVE-2026-42389: Improper Input Validation

This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers...

CVE-2026-42388: Improper Input Validation

Incomplete validation of the SOA record present in a catalog zone might lead to a crash...

CVE-2026-42387: Improper Input Validation

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation...

CVE-2026-2815: Small Seed Space in PRNG

Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys...

CVE-2026-40208: Incorrect Control Flow Scoping

An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame...

CVE-2026-40011: Improper Encoding or Escaping of Output

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires...

CVE-2026-42005: Uncontrolled Resource Consumption

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default...

CVE-2026-33612: Acceptance of Extraneous Untrusted Data With Trusted Data

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning...

CVE-2026-6432: Improper Handling of Length Parameter Inconsistency

Improper bounds validation in EmberZNet SDK versions 9.0.2 and earlier may result in crashes or dynamic memory leakage...

CVE-2026-54090: Improper Neutralization of Special Elements used in a Command

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.33.8, when a shell interpreter is configured e.g. /bin/sh -c, the command allowlist can be bypassed through shell metacharacters. The allowlist...

CVE-2026-6092: Selection of Less-Secure Algorithm During Negotiation

When HAVEENCRYPTTHENMAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC...

CVE-2026-55960: Improper Certificate Validation

Un-negotiated Raw Public Key RFC 7250 accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelative accepts it without performing any trust verification; it must therefore only be accepted when RPK was actually negotiated for that peer...