CVE-2026-49174

Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...

CVE-2026-49175

Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally...

CVE-2026-50487

CVE-2026-50487 is a Windows DNS Client use-after-free memory corruption vulnerability in the Windows DNS component that allows a network-based attacker to elevate privileges without user interaction. Affected product: Microsoft Windows DNS Client. Root cause: use-after-free in DNS handling leadin...

CVE-2026-50465 Windows DNS Client Tampering Vulnerability

...

CVE-2026-50426

CVE-2026-50426 : Windows DNS Server contains a relative path traversal vulnerability that could allow an authorized attacker on an adjacent network to execute code. Root cause is traversal of relative paths in DNS Server handling, enabling remote code execution. Reported impact is arbitrary code ...

CVE-2026-50295

Technical details about CVE-2026-50295 are not publicly provided in the supplied documents. Monitor for updates from official sources.

CVE-2026-49174 DNS Client Tampering Vulnerability

...

CVE-2026-49174

CVE-2026-49174 describes a vulnerability in Microsoft Windows DNS where missing authentication for a critical function could allow a locally authorized attacker to tamper with DNS behavior. The NVD entry notes a CVSS v3.1 base score of 6.1 (Medium) with a LOCAL attack vector, LOW attack complexit...

CVE-2026-49175 Windows DNS Client Elevation of Privilege Vulnerability

...

CVE-2026-49175 Windows DNS Client Elevation of Privilege Vulnerability

...

CVE-2026-49169 Windows DNS Server Remote Code Execution Vulnerability

...

Windows DNS Client Tampering Vulnerability

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...

Windows DNS Server Remote Code Execution Vulnerability

Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network...

Windows Zero Trust DNS Security Feature Bypass Vulnerability

Improper privilege management in Microsoft Windows DNS allows an authorized attacker to bypass a security feature locally...

PT-2026-58469

Name of the Vulnerable Software and Affected Versions Microsoft Windows DNS affected versions not specified Description Improper access control in the Windows DNS Client allows an authorized, logged-in attacker to perform local tampering. Recommendations At the moment, there is no information abo...

ALSA-2026:39573 Important: yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fixes: net: golang: Go net package: Denial of Service vi...

CVE-2026-62240 CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

PYSEC-2026-3438 zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet

Impact readcharacterstring and readstring in src/zeroconf/protocol/incoming.py sliced self.dataself.offset : self.offset + length and advanced self.offset by the declared length without checking it against self.datalen. Python's slice silently returns fewer bytes when the end index runs past the...

python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

ImpactAsyncListener.handlequeryordefer retained every truncated TC-bit incoming query in self.deferredaddr and armed a per-addr timer in self.timersaddr that flushed the reassembled query within 500 ms RFC 6762 §18.5. Neither the per-addr list nor the number of distinct addr keys was capped, and...