The vulnerability of the DNS-over-HTTPS (DoH) method in the Coredns DNS server allows a attacker to induce a service failure.

The vulnerability of the DNS-over-HTTPS DoH method used by the coredns DNS server is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Malicious code in pfp-integration-mobile-heading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3428631054a61f4fd2a14f372d7c782dd08633446897b0ee0959d259496d170 On require of the package, bootstrap.js selects a platform-specific binary path, downloads an opaque executable over HTTPS from a rotating list of...

SUSE SLES15 Security Update : bind (SUSE-SU-2026:2676-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2676-1 advisory. This update for bind fixes the following issues - CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation...

Security update for bind

This update for bind fixes the following issues CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation bsc1265591. CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records bsc1265592. CVE-2026-5946: Invalid handling of CLASS != IN bsc1265594. CVE-2026-595...

Linux Distros Unpatched Vulnerability : CVE-2026-40208

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame. CVE-2026-40208 Note that Nessus relies...

SUSE CVE-2026-40208

An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame...

SUSE SLES16: bind / bind-doc / bind-modules-generic / bind-modules-ldap / etc (SUSE-SU-2026:22198-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22198-1 advisory. This update for bind fixes the following issues Upgrade to release 9.20.23: - CVE-2026-3039: BIND 9 server memory exhaustion durin...

GO-2026-5583 CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC in github.com/coredns/coredns

CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC in github.com/coredns/coredns...

GO-2026-5164 CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification in github.com/coredns/coredns

CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification in github.com/coredns/coredns...

CVE-2026-40208

An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame...

CVE-2026-40208

An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame...

CVE-2026-40208

An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame...

CVE-2026-40208 Denial of service via DoH3 queries

An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame...

CVE-2026-40208

CVE-2026-40208 concerns DoH3 servers handling DoH3 GET queries with an invalid DATA frame, potentially delaying processing and causing a denial of service. The available records state the impact as availability loss (LOW) with a CVSS 3.1 base score of 3.7, network-exposed and requiring no privile...

CVE-2026-40208 Denial of service via DoH3 queries

An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame...

PT-2026-52380

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An attacker can delay the processing of DNS over HTTPS DoH3 queries by sending DoH3 GET queries containing an invalid DATA frame. Recommendations At the moment,...

OPENSUSE-SU-2026:21015-1 Security update for dnsdist

This update for dnsdist fixes the following issues - CVE-2026-0396: crafted DNS queries can allow to inject HTML content bsc1261236. - CVE-2026-0397: CORS misconfiguration can lead to information disclosure bsc1261237. - CVE-2026-24028: crafted DNS response packet can lead to an out-of-bounds rea...

SUSE-SU-2026:22319-1 Security update for dnsdist

This update for dnsdist fixes the following issues - CVE-2026-0396: crafted DNS queries can allow to inject HTML content bsc1261236. - CVE-2026-0397: CORS misconfiguration can lead to information disclosure bsc1261237. - CVE-2026-24028: crafted DNS response packet can lead to an out-of-bounds rea...

SUSE-SU-2026:22198-1 Security update for bind

This update for bind fixes the following issues Upgrade to release 9.20.23: - CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation bsc1265591. - CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records bsc1265592. - CVE-2026-3593: Heap use-after-free...

ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories

The internet did not break this week. It got used exactly as designed, which is worse. Searches were siphoned through shady browser add-ons. AI chat links turned into malware delivery paths. macOS attacks ran in memory and left almost nothing behind. Cloud agents looked like helpers until attacke...