CVE-2026-107381: Improper Handling of Case Sensitivity

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences in src/ElementReference/Resolver.php builds the SVG reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes normalizes mixed-case names. An attacker can provide xlink:HrEf on...

rsync: Fix of 6 CVEs

CVE-2026-53784: confine the daemon's absolute chdir target with a new ownership-walk resolver so a planted parent symlink cannot steer a "use chroot = no" module root outside the module - CVE-2026-53786: strip a real moduledir prefix before the daemon-filter check on a merge-file path -- leaving...

Security update for bind

This update for bind fixes the following issues: CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification bsc1280430. CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver bsc1280432. CVE-2026-19666: Use-after-free in...

SUSE-SU-2026:4635-1 Security update for bind

This update for bind fixes the following issues: - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification bsc1280430. - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver bsc1280432. - CVE-2026-19666: Use-after-free in...

EUVD-2026-98158

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

kresd DNS Resolver Code Execution

The vulnerability of the kresd DNS resolver’s knot resolver component is related to incorrect configuration data input. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

DEBIAN-CVE-2026-109595

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

CVE-2026-109595 Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

CVE-2026-109595 Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

CVE-2026-109595

Hugo versions v0.84.0 before v0.167.0 are vulnerable to a path traversal vulnerability. The issue resides in the ESBuild fallback resolver used by the js.Build , js.Batch , and css.Build functions. This allows malicious themes or modules to use relative imports or symlinks to read files outside t...

CVE-2026-109595 Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...

CVE-2026-109595: Improper Limitation of a Pathname to a Restricted Directory

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

EulerOS 2.0 SP11 : dhcp (EulerOS-SA-2026-4221)

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone...

EulerOS 2.0 SP11 : dhcp (EulerOS-SA-2026-4312)

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone...

Amazon Linux 2 : bind (ALAS-2026-3995)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3995 advisory. For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer...

zdns

ZDNS ZDNS es un resolvedor DNS de alta velocidad y una utilidad de línea de comandos para realizar mediciones DNS a gran escala. ZDNS está escrito en Go y contiene su propio código de resolución recursiva y una caché optimizada para realizar consultas de un conjunto diverso de nombres. Usamos...

Malicious code in nft-metadata-resolver (RubyGems)

Source: amazon-inspector ee87c382dfd443e81b4cf0e8dc66749f9a129bd4239f984859aaaf760e84c629 The gem ships a native-extension script at ext/nftmetadataresolver/extconf.rb that RubyGems auto-executes during gem install. The script carries a base64-encoded Ruby payload, decodes it with Base64.decode64...

puredns

Resolvedor rápido de dominios y fuerza bruta de subdominios con filtrado preciso de comodines wildcards Primeros pasos » Uso · Cómo funciona · Patrocinio · Preguntas frecuentes Acerca de puredns es un resolvedor rápido de dominios y una herramienta de fuerza bruta de subdominios que puede filtrar...

massdns

MassDNS Un resolvedor de stub DNS de alto rendimiento MassDNS es un resolvedor de stub DNS simple y de alto rendimiento dirigido a aquellos que buscan resolver una cantidad masiva de nombres de dominio en el orden de millones o incluso miles de millones. Sin una configuración especial, MassDNS es...