PT-2026-140277

Apache Airflow's secrets masker matched sensitive key names only in their snake case form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template...

CVE-2026-118468: CompuGroup Medical: XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled,…

XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity XXE attacks...

CVE-2026-111452: Apache Software Foundation Apache Airflow: Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under…

Apache Airflow's secrets masker matched sensitive key names only in their snakecase form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template...

PT-2026-140385

XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity XXE attacks...

EUVD-2026-119676

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.1.0 does not validate or improperly validates TLS certificate validation when communicating with remote cluster GUI interfaces, which could allow an attacker to inject forged JSON responses using man in the middle techniques...

CVE-2026-14375 The following vulnerabilities that can affect IBM Storage Scale Install Toolkit are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.1.0 does not validate or improperly validates TLS certificate validation when communicating with remote cluster GUI interfaces, which could allow an attacker to inject forged JSON responses using man in the middle techniques...

CVE-2026-14375

The IBM Storage Scale Install Toolkit is impacted by a vulnerability where the software fails to properly validate TLS certificates when communicating with remote cluster GUI interfaces. This improper certificate validation (CWE-295) could allow an attacker to perform a man-in-the-middle attack t...

CVE-2026-124425

Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect...

EUVD-2026-119575

Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect...

CVE-2026-124425

The Parse Server software versions 8.6.109 (before 8.6.116) and 9.10.6-alpha.1 (before 9.10.7-alpha.2) are vulnerable to an information disclosure flaw. The root cause is that create or update responses mark fields as deleted based on stored values that the caller is not authorized to read. Conse...

CVE-2026-123601

Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the wrap-around branch of findcoveringrecord in nsec3.rs, so the last NSEC3 record in a zone's hash ring covers every hash except its owner. Attackers able to...

CVE-2026-123583

The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache...

CVE-2026-123579

DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a zone with wildcard records, an attacker can combine an NSEC...

EUVD-2026-119363

Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::trysend, which re-queues truncated TC responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps th...

CVE-2026-123601 Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery

Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the wrap-around branch of findcoveringrecord in nsec3.rs, so the last NSEC3 record in a zone's hash ring covers every hash except its owner. Attackers able to...

CVE-2026-123601 Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery

Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the wrap-around branch of findcoveringrecord in nsec3.rs, so the last NSEC3 record in a zone's hash ring covers every hash except its owner. Attackers able to...

EUVD-2026-119358

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verifyrrsets ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply...

CVE-2026-123599

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verifyrrsets ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply...

CVE-2026-123584 Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses

The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can spoof malformed...

CVE-2026-123584

The hickory-net crate in Hickory DNS versions 0.26.0 before 0.26.2 is vulnerable to a UDP Client Denial of Service via spoofed responses . The root cause is that the component stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a valid DN...