CVE-2026-55991

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion if compiled with assertions on and terminate the entire Unbound process using a single DNS-over-QUIC DoQ connection and one normal DNS query. This is caused by an erroneous...

CVE-2026-55991 Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion if compiled with assertions on and terminate the entire Unbound process using a single DNS-over-QUIC DoQ connection and one normal DNS query. This is caused by an erroneous...

CVE-2026-55991

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion if compiled with assertions on and terminate the entire Unbound process using a single DNS-over-QUIC DoQ connection and one normal DNS query. This is caused by an erroneous...

CVE-2026-55991 Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion if compiled with assertions on and terminate the entire Unbound process using a single DNS-over-QUIC DoQ connection and one normal DNS query. This is caused by an erroneous...

EUVD-2026-47683

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion if compiled with assertions on and terminate the entire Unbound process using a single DNS-over-QUIC DoQ connection and one normal DNS query. This is caused by an erroneous...

CVE-2026-55973

CVE-2026-55973 affects NLnet Labs Unbound 1.23.0 through 1.25.1. When dns-error-reporting: yes is enabled, the EDNS Report-Channel option (code 18) length from the last upstream response is treated as the length of the agent domain. If the agent domain contains garbage after the domain, those byt...

CVE-2026-55973 'dns-error-reporting: yes' leads to stack buffer overflow

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...

EUVD-2026-47681

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...

CVE-2026-55973

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...

CVE-2026-55973

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...

CVE-2026-55973 'dns-error-reporting: yes' leads to stack buffer overflow

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...

CVE-2026-55973

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...

Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question is CVE-2026-29059 CVSS score: 7.5, a case of unauthenticated path traversal impacting Windmill's "getlogfile" endpoint...

kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc

A flaw was found in the Linux kernel's crypto AFALG subsystem. Memory allocated via sockkmalloc for crypto user API contexts is not zero-initialized, leaving fields with garbage values. Specifically, the 'inflight' variable can contain random data, causing afalgallocareq to spuriously return -EBU...

pocumentary

An open-source project from Pillar Security PoCumentary T...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-1933 DESCRIPTION: A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks,...

CVE-2026-64028

A flaw was found in the Linux kernel's tracing subsystem. The histfieldname function, responsible for handling field names, can return a NULL value if a long variable name in a fully-qualified reference causes snprintf truncation. This unexpected NULL return can lead to a NULL pointer dereference...

CVE-2026-64024

A flaw was found in the Linux kernel's Transmission Control Protocol TCP networking stack. This vulnerability arises from a stale per-CPU variable that can retain a previously used Initial Sequence Number ISN when certain packets are dropped. A remote attacker could exploit this by sending...

PT-2026-63389

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.23.0 through 1.25.1 Description When the dns-error-reporting: yes setting is enabled, the software incorrectly processes the EDNS Report-Channel option code 18 from upstream responses. Specifically, it uses the...

PT-2026-63542

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 3.16 Description An issue exists in the validateLocalUri method where chroot boundaries are enforced using a strpos prefix check after paths are normalized with realpath. Because normalization removes the trailing...