Lucene search
+L

31726 matches found

OSV
OSV
added 2026/07/22 8:33 p.m.6 views

MAL-2026-11004 Malicious code in n8n-nodes-pwn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae8222d3f90f4cff83a0840ee03f4b127946274f0215a73eadd6008404a2276e The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP socket to 10.0.0.145:4444 an...

5.8AI score
SaveExploits0References5
OSV
OSV
added 2026/07/22 5:53 p.m.7 views

DRUPAL-CONTRIB-2026-081

In a scenario of a multilingual website with different domain names per language, this module enables you to be automatically connected across the language domains if you are logged on the main language domain. The module doesn't sufficiently validate a short-lived token, allowing an attacker to...

5.4AI score
SaveExploits0References1
OSV
OSV
added 2026/07/22 2:17 p.m.8 views

CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

5.9CVSS5.8AI score
SaveExploits0References1
NVD
NVD
added 2026/07/22 2:17 p.m.8 views

CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

5.9CVSS0.00237EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/22 2:17 p.m.6 views

CVE-2026-50243

In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer...

3.7CVSS5.8AI score
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/22 1:9 p.m.47 views

CVE-2026-55717 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

5.9CVSS0.00237EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/07/22 1:9 p.m.8 views

CVE-2026-55717 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

5.9CVSS5.4AI score0.00237EPSS
SaveExploits0References1
AlpineLinux
AlpineLinux
added 2026/07/22 1:9 p.m.8 views

CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

5.9CVSS5.8AI score0.00237EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/07/22 1:9 p.m.7 views

CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

5.9CVSS5.4AI score0.00237EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/07/22 1:9 p.m.9 views

EUVD-2026-47680

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

5.9CVSS5.4AI score0.00237EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/22 1:8 p.m.45 views

CVE-2026-50243 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL

In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer...

6.3CVSS0.00107EPSS
SaveExploits0References1
AlpineLinux
AlpineLinux
added 2026/07/22 1:8 p.m.7 views

CVE-2026-50243

In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer...

6.3CVSS5.8AI score0.00107EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/07/22 1:4 p.m.35 views

CVE-2026-41637 Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC DoQ queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service f...

3.7CVSS0.00265EPSS
SaveExploits0References1
RedHat Linux
RedHat Linux
added 2026/07/22 6:55 a.m.18 views

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

7.8CVSS6.3AI score0.0013EPSS
SaveExploits1References5
Drupal
Drupal
added 2026/07/22 12:0 a.m.5 views

Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081

In a scenario of a multilingual website with different domain names per language, this module enables you to be automatically connected across the language domains if you are logged on the main language domain. The module doesn't sufficiently validate a short-lived token, allowing an attacker to...

5.4AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/22 12:0 a.m.16 views

PT-2026-63388

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.10.0 through 1.25.1 Description A remote client controlling a delegated domain can cause the daemon to crash, leading to a denial of service. This occurs when the serve-expired: yes setting is enabled alongside a...

5.9CVSS5.9AI score0.00237EPSS
SaveExploits0References30
Positive Technologies
Positive Technologies
added 2026/07/22 12:0 a.m.25 views

PT-2026-63372

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.25.1 Description Client terminated DNS-over-QUIC DoQ queries are not accounted for properly, leading to an inflation of the waiting number of replies for in-flight resolution queries. This causes a...

3.7CVSS5.8AI score0.00265EPSS
SaveExploits0References30
RedhatCVE
RedhatCVE
added 2026/07/21 9:30 p.m.7 views

CVE-2026-63924

A flaw was found in the Linux kernel's handling of IPv6 extended headers. Specifically, the ipv6hopjumbo function, which processes jumbo payloads, can modify internal packet buffer skb pointers. However, the network header nh pointer is not recomputed after these modifications. This oversight cou...

9.8CVSS5.4AI score0.00695EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/07/21 9:9 p.m.6 views

CVE-2026-63912

A flaw was found in the Linux kernel's Encapsulating Security Payload ESP component. This vulnerability occurs in the ESP out-of-place fast path when handling combined single-fragment lengths. An attacker could potentially trigger a scenario where the system rejects the page-fragment fast path,...

9.8CVSS5.3AI score0.00704EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/21 8:48 p.m.11 views

CVE-2026-65056

CVE-2026-65056 describes a server-side request forgery in mcp-webresearch 0.1.7. The vulnerability arises because visit_page validates only URL protocol and does not filter private or reserved IP ranges, enabling an attacker to access internal network services by supplying loopback, link-local, o...

8.3CVSS5.4AI score0.00231EPSS
SaveExploits0References3
Rows per page
Query Builder