3685 matches found
CVE-2026-97360 HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...
CVE-2026-97360 HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...
EUVD-2026-85880
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...
[SECURITY] Fedora 44 Update: unbound-1.26.1-1.fc44
Unbound is a validating, recursive, and caching DNSSEC resolver. The C implementation of Unbound is developed and maintained by NLnet Labs. It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modula...
PT-2026-97806
Name of the Vulnerable Software and Affected Versions HFS2 versions 2.4.0 and earlier Description An unauthenticated arbitrary file access issue exists due to a lack of an authorization model in the macro dispatcher and a failure in the path resolver to confine absolute paths. This allows...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124477)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124477 advisory. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. Tenable has extracted the preceding...
CVE-2026-97360: Missing Authorization
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...
ROOT-OS-DEBIAN-13-CVE-2026-44690 CVE-2026-44690 in unbound - Patched by Root
Root has patched CVE-2026-44690 in the unbound package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-40691 CVE-2026-40691 in unbound - Patched by Root
Root has patched CVE-2026-40691 in the unbound package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-50252 CVE-2026-50252 in unbound - Patched by Root
Root has patched CVE-2026-50252 in the unbound package for Root:Debian:13. Multiple fixed versions available...
SUSE CVE-2026-19668
A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through...
SUSE CVE-2026-19941
An inapplicable NSEC record may be accepted by a named resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0...
SUSE CVE-2026-80274
If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions...
SUSE CVE-2026-81563
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This...
CLSA-2026-1790104586 TuxCare security update for pac-resolver (1 CVE)
TuxCare rebuilt pac-resolver to address 1 CVE. Fixed in 4.2.0-tuxcare.1...
CVE-2026-93657
A flaw was found in hickory-resolver. This vulnerability allows attackers to bypass Domain Name System Security Extensions DNSSEC authentication checks. By controlling the answering zone or being positioned on the network path, an attacker can have forged DNS records accepted as validated, leadin...
ROOT-OS-DEBIAN-12-CVE-2026-44690 CVE-2026-44690 in unbound - Patched by Root
Root has patched CVE-2026-44690 in the unbound package for Root:Debian:12. Multiple fixed versions available...