4944 matches found
CVE-2026-123583 Hickory DNS 0.25.0 through 0.25.2 Missing Bailiwick Filtering on Negative Responses
The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache...
CVE-2026-123583
The recursive resolver in Hickory DNS (specifically hickory-recursor versions 0.25.0 through 0.25.2 and hickory-resolver versions 0.26.0 before 0.26.2) fails to apply out-of-bailiwick filtering to negative responses. An attacker can provide crafted negative responses containing out-of-bailiwick r...
CVE-2026-123583 Hickory DNS 0.25.0 through 0.25.2 Missing Bailiwick Filtering on Negative Responses
The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache...
EUVD-2026-119342
The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache...
EUVD-2026-119340
Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can...
CVE-2026-123581
Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can...
CVE-2026-123579
DNSSEC validation in Hickory DNS (specifically hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1) is vulnerable to a validation bypass due to how wildcard expansions are handled. The root cause is that the software fails to distinguish NODATA responses from wildcard...
EUVD-2026-119410
Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments o...
PT-2026-139864
The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache...
CVE-2026-123583: hickory-dns: The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2…
The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache...
CVE-2026-123599: hickory-dns: Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because…
Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verifyrrsets ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply...
PT-2026-139941
Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect...
CVE-2026-124425: parse-community parse-server: Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure…
Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect...
PT-2026-140050
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.1.0 does not validate or improperly validates TLS certificate validation when communicating with remote cluster GUI interfaces, which could allow an attacker to inject forged JSON responses using man in the middle techniques...
CVE-2026-123604: hickory-dns: Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send,…
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::trysend, which re-queues truncated TC responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps th...
send
@fastify/send Send is a library for streaming files from the file system as an HTTP response supporting partial responses Ranges, conditional-GET negotiation If-Match, If-Unmodified-Since, If-None-Match, If-Modified-Since, high test coverage, and granular events which may be leveraged to take...
EVIL-CVE-2021-23017-Update-2025
vulnerability in NGINX servers versions 0.6.18–1.20.0. The scripts aim to cause a Denial of Service DoS by sending malicious DNS responses, with enhancements to bypass firewalls. This is an improved version of the original PoC from M507/CVE-2021-23017-PoC . Warning : Use only with explicit writte...
CVE-2026-55255-Lab
CVE-2026-55255 - Langflow IDOR in /api/v1/responses Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-55255, an Insecure Direct Object Reference IDOR vulnerability affecting Langflow's OpenAI-compatible Responses API. Langflow is an open-source...
dnspooq
dnspooq DNSpooq PoC - dnsmasq cache poisoning CVE-2020-25686, CVE-2020-25684, CVE-2020-25685 For educational purposes only Requirements Docker compose Docker Exploit Launch containers $ docker-compose up -d Run exploit.py $ docker-compose exec attacker bash bash-5.0 python exploit.py Querying...
