261900 matches found
CVE-2026-11622
A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...
CVE-2026-60642
creationtimestamp| type| source ---|---|--- 2026-07-22 14:10:29+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mraittycpx2t 2026-07-22 14:10:30+00:00| seen| https://mastodon.social/users/hugovalters/statuses/116964027874383696 2026-07-23 17:22:18+00:00| seen|...
EUVD-2026-47693
In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation...
CVE-2026-13184 RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock...
CVE-2026-55973
In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...
CVE-2026-55708
NLnet Labs Unbound v1.6.0–1.25.1 is affected. The vulnerability stems from the view_local_data and view_local_datas commands in unbound-control, which can create a bare local zones tree for an already configured named view when the view starts without local data. The created tree omits default-pr...
CVE-2026-50248
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...
CVE-2026-65598
creationtimestamp| type| source ---|---|--- 2026-07-22 13:04:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mraf5rtpf62i 2026-07-28 18:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrq2k4jcre22...
CVE-2026-16560
A heap-buffer-overflow flaw was found in Directory Server 389-ds-base. When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation...
tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...
ROOT-APP-PYPI-CVE-2026-3515 CVE-2026-3515 in rootio-prefect - Patched by Root
Root has patched CVE-2026-3515 in the rootio-prefect package for Root:PyPI. Multiple fixed versions available...
EUVD-2026-47654
Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10...
CVE-2026-65594 n8n before 2.30.1 Missing OAuth Authorization Check
n8n before 2.29.8 and 2.30.x before 2.30.1 affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger...
New Ubuntu Desktop Vulnerability Turns Local Access Into Root Control
A vulnerability in snap-confine lets an unprivileged user gain root access on affected Ubuntu Desktop systems. Install the latest snapd update to fix the issue...
ROOT-APP-NPM-CVE-2026-27699 CVE-2026-27699 in @rootio/basic-ftp - Patched by Root
Root has patched CVE-2026-27699 in the @rootio/basic-ftp package for Root:npm. Multiple fixed versions available...
Important: Red Hat Security Advisory: evince security update
An update for evince is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...
ROOT-APP-NPM-CVE-2020-7660 CVE-2020-7660 in @rootio/serialize-javascript - Patched by Root
Root has patched CVE-2020-7660 in the @rootio/serialize-javascript package for Root:npm. Multiple fixed versions available...
CVE-2026-63048
creationtimestamp| type| source ---|---|--- 2026-07-22 08:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr7wezhseo2r 2026-07-22 08:51:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr7wyuajaw23 2026-07-22 09:00:33+00:00| seen|...
CVE-2026-63047
The CVE-2026-63047 vulnerability affects the Joomla extension Events Booking prior version 5.0-5.8.1, where an ACL/permissions check failed to properly verify that an actor is allowed to download invoice information. The underlying issue is an improper access-control check that could enable exfil...