CVE-2026-44690

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary...

CVE-2026-44690

The CVE-2026-44690 entry concerns NLnet Labs Unbound versions 1.7.0 through 1.25.1 where insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing enables cache poisoning. A malicious actor controlling a single delegated zone...

CVE-2026-44690

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary...

EUVD-2026-47669

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary...

CVE-2026-44690 Cross-zone wildcard cache poisoning via RRSIG.labels manipulation

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary...

Security update for multipath-tools

This update for multipath-tools fixes the following issues: Update to version 0.9.8+292+suse.c0523c1. kpartx: integer overflow in the GPT partition table size calculation can lead to heap OOB read via crafted USB device or disk imagebsc1268145. kpartx: missing bounds check can lead to a DASD VOL1...

openSUSE 16 Security Update : ctop (openSUSE-SU-2026:21379-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21379-1 advisory. Changes in ctop embedded dependencies: - CVE-2022-21698: clientgolang: Denial of service using InstrumentHandlerCounter bsc1248710 -...

PT-2026-63417

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description An attacker can respond ...

GHSA-V73X-HX65-6PF4 Gitea: Unauthorized Access to Labels of Private Organizations

Summary Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpoints. A user without access to a private organization can retrieve labels belonging to that organization through the Organization Labels API. As a result, label metadata intended to...

EUVD-2026-41621

Gitea: Unauthorized Access to Labels of Private Organizations...

CVE-2026-47687 FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the selectForm helper in fogpage.class.php renders labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address...

CVE-2026-47687

FOGProject vulnerability CVE-2026-47687: an unauthenticated attacker who knows a registered host MAC can post a crafted sysproduct to /service/inventory.php, causing the selectForm() helper to render unescaped input in option labels. This stored value is eventually displayed when an administrator...

CVE-2026-47414

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoints — PATCH /workspaces/workspaceid/labels/labelid, DELETE .../labels/labelid, POST .../issues/issueid/labels/labelid, DELETE...

CVE-2026-47414

CVE-2026-47414 – cross-workspace IDOR in PraisonAI Label endpoints Technical details across Connected documents show concrete flaws in PraisonAI Platform up to version 0.1.3 (older than 0.1.4): five label-related endpoints allow arbitrary label_id/issue_id values to be used without verifying work...

libvirt security update

11.10.0-12.4.0.1 - Set SOURCEDATEEPOCH from changelog Orabug: 32019554 11.10.0-12.4.el102 - cpuconf: Introduce virCPUDefSortFeatures RHEL-180449 - qemucapabilities: Split virQEMUCapsFillDomainCPUCaps RHEL-180449 - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel...

PT-2026-63310

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.4 Description An authenticated user can use a specific API endpoint as a cross-repository label-ID existence and enumeration oracle. This occurs because the system performs a global, unscoped lookup of labels by ID...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

TencentOS Server 3: git-lfs (TSSA-2026:0637)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0637 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...