CVE-2026-19033 Unauthenticated IXFR deltas are applied to the live zone before TSIG verification

For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to ...

CVE-2026-19033

For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to ...

EUVD-2026-80767

A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server e.g., via zone transfer, queries for names inside the configured zone then lose authoritative status and return an...

CVE-2026-78301

A malformed zone may contain an NS or DNAME node above its origin, which "named" treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server e.g., via zone transfer, queries for names inside the configured zone then lose authoritative status and return an...

CVE-2026-78301 Out-of-zone database nodes can become authoritative zone cuts

A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server e.g., via zone transfer, queries for names inside the configured zone then lose authoritative status and return an...

CVE-2026-78301 Out-of-zone database nodes can become authoritative zone cuts

A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server e.g., via zone transfer, queries for names inside the configured zone then lose authoritative status and return an...

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling

A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successf...

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling

A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successf...

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling

A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successf...

CVE-2026-8030

CVE-2026-8030 is a Missing Authorization vulnerability in GitLab CE/EE affecting versions 13.0 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1 . The root cause is improper validation of group URL slugs during namespace transfers , which under certain conditions allowed an authenticat...

EUVD-2026-80119

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

CVE-2026-84997: Loop with Unreachable Exit Condition

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every...

PT-2026-93758

Name of the Vulnerable Software and Affected Versions react/http versions 0.6.0 through 1.11.0 Description A denial of service issue exists where a malformed HTTP message using Transfer-Encoding: chunked can cause the ReactHttpIoChunkedDecoder to enter an infinite loop. This occurs because the...

CVE-2026-92582: Cross-Site Request Forgery (CSRF)

AVideo WWBN/AVideo through 29.0 commit e01e41ecc is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check $global'bypassSameDomainCheck' merely because 'user' and 'pass' parameters a...

CVE-2026-20194: Incorrect Resource Transfer Between Spheres

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

PT-2026-93741

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.27 BIND 9 versions 9.21.0 through 9.21.25 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.27-S1 Description In a secondary zone wher...

CVE-2026-19033: Acceptance of Extraneous Untrusted Data With Trusted Data

For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to ...

CVE-2026-78301: Acceptance of Extraneous Untrusted Data With Trusted Data

A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server e.g., via zone transfer, queries for names inside the configured zone then lose authoritative status and return an...

CVE-2026-19033: Acceptance of Extraneous Untrusted Data With Trusted Data

For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to ...

PT-2026-94099

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 commit e01e41ecc Description Cross-site request forgery occurs because the endpoint 'objects/videoAddNew.json.php' disables the automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check...