CVE-2026-44276

Dell PowerProtect Data Manager prior to version 20.2.0.0 contains CVE-2026-44276: REST API exposes sensitive information to an unauthorized actor. A high-privilege attacker with local access could potentially exploit this vulnerability to cause information exposure (CVSSv3.1: 6.0, Local attack, P...

gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name

A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name SAN could cause the validation process to incorrectly fall back to checking the Common Name CN field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to...

ALPINE-CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

ALPINE-CVE-2026-55973

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...

CVE-2026-32665

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC DoQ is enabled, the first two bidirectional streams on a new QUIC connection streamid 0 and 4 bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte...

unbound: NLnet Labs Unbound: Denial of Service via faulty DNSCrypt configuration

A flaw was found in Unbound when configured with DNSCrypt support. An unauthenticated remote attacker could exploit a faulty configuration, where an imbalance between DNSCrypt provider certificate and secret key files leads to memory corruption. By sending a specially crafted network request, the...

unbound: NLnet Labs Unbound: Denial of Service via crafted DNS glue records

A flaw was found in Unbound. A remote malicious actor can exploit a vulnerability by controlling a DNS delegation that returns specific glue records. This can cause Unbound to repeatedly clear its DNS caches, leading to a continuous Denial of Service DoS for DNS resolution...

unbound: Unbound: DNS cache integrity issue

A "ghost domain names" flaw in Unbound allows a remote attacker controlling a domain to manipulate cached DNS records. By extending the lifetime of outdated DNS information, an attacker can cause clients to receive stale or misleading DNS responses...

unbound: Unbound: Denial of Service due to freed pointer dereference in DNS-over-TLS handling

A use-after-free flaw was found in Unbound's DNS-over-TLS DoT forwarded query handling. A remote attacker can exploit a timing error during TLS handshake failures on a server under load to trigger a daemon crash, resulting in a Denial of Service DoS...

CVE-2026-11721

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For...

thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data

A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data also known as data amplification, allows a remote attacker to cause a Denial of Service DoS by sending specially crafted, highly compressed data. The affected component fails to...

CVE-2026-62144

An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security...

EUVD-2026-47700

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security polici...

CVE-2026-13190

The CVE affects Progress Telerik UI for ASP.NET AJAX. Before version 2026.2.708, the Persistence Framework’s deserialization utilities allow unsafe type instantiation from attacker-controlled persisted state, enabling remote code execution. Impact is high (network vector, no privileges required, ...

CVE-2026-13190 PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution...

EUVD-2026-47696

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution...

CVE-2026-13183

The vulnerability CVE-2026-13183 affects In Progress Telerik UI for ASP.NET AJAX, specifically the RadAsyncUpload component prior to version 2026.2.708. The root cause is a flaw in upload metadata processing that may allow an attacker to infer cryptographic validity through measurable timing diff...

CVE-2026-13183

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values...

EUVD-2026-47688

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values...

EUVD-2026-47686

In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments...