36557 matches found
CVE-2026-55002
Technical details about CVE-2026-55002 are not publicly available in the provided documents. Monitor for updates.
CVE-2026-49174 DNS Client Tampering Vulnerability
...
CVE-2026-49174
CVE-2026-49174 describes a vulnerability in Microsoft Windows DNS where missing authentication for a critical function could allow a locally authorized attacker to tamper with DNS behavior. The NVD entry notes a CVSS v3.1 base score of 6.1 (Medium) with a LOCAL attack vector, LOW attack complexit...
CVE-2026-49175
CVE-2026-49175 is a Windows DNS Client vulnerability described as a heap-based buffer overflow that allows an authorized attacker to achieve local privilege escalation. The issue affects the Windows DNS client and is characterized by a LOCAL attack vector with low attack complexity and the need f...
CVE-2026-49169
CVE-2026-49169 affects Windows DNS Server. The vulnerability is a use-after-free in the DNS Server that enables remote code execution when exploited over a network by an authenticated attacker. Exploitation details are not provided in the supplied documents beyond the CVSS 3.1 score (8.0, HIGH) w...
CVE-2026-49169 Windows DNS Server Remote Code Execution Vulnerability
...
CVE-2026-15428
The CVE-2026-15428 entry concerns Archer VX800v (v1) and related CXE/ CWMP management exposure. The underlying issue is insufficient input sanitization of the domain name parameter in the HTTP interface, enabling an adjacent attacker to inject shell metacharacters and achieve arbitrary code execu...
CVE-2026-15428 OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v
An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with...
CVE-2026-10670
The CONFIGUSERSPACE verification handler for the kthreadnamecopy system call zvrfykthreadnamecopy in kernel/thread.c calls kobjectfind on the caller-supplied thread pointer and then dereferences the returned struct kobject without checking it for NULL. kobjectfind returns NULL whenever the suppli...
USN-8539-1: GnuTLS vulnerabilities
Haruto Kimura discovered that GnuTLS did not properly apply permitted name constraints in certain certificate validation paths. A remote attacker could possibly use this issue to bypass certificate validation, leading to a machine-in-the-middle attack. CVE-2026-42011 Oleh Konko discovered that...
CVE-2026-10670 User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier
The CONFIGUSERSPACE verification handler for the kthreadnamecopy system call zvrfykthreadnamecopy in kernel/thread.c calls kobjectfind on the caller-supplied thread pointer and then dereferences the returned struct kobject without checking it for NULL. kobjectfind returns NULL whenever the suppli...
CVE-2026-10670 User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier
The CONFIGUSERSPACE verification handler for the kthreadnamecopy system call zvrfykthreadnamecopy in kernel/thread.c calls kobjectfind on the caller-supplied thread pointer and then dereferences the returned struct kobject without checking it for NULL. kobjectfind returns NULL whenever the suppli...
CVE-2026-10670
The CVE describes a local denial of service in Zephyr’s kernel: the CONFIG_USERSPACE verifier for k_thread_name_copy() dereferences ko without NULL checking after k_object_find() returns NULL for unregistered pointers. This NULL dereference occurs in supervisor mode, causing a kernel fault and po...
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...
Windows DNS Server Remote Code Execution Vulnerability
Use after free in DNS Server allows an authorized attacker to execute code over a network...
DNS Client Tampering Vulnerability
Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...
Windows DNS Client Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally...
DNS Client Tampering Vulnerability
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...