Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler

Elementor Pro plugin for WordPress in versions =4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation and processfield methods iterate over submitted file entries with different early-exit logic for UPLOADERRNOFILE entries. When an...

SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id

The SureForms plugin for WordPress is vulnerable to payment amount validation bypass in versions up to, and including, 2.5.2. The createpaymentintent AJAX handler checks if $formid 0 && !empty$blockid before calling validatepaymentamount. By sending formid=0 the default intval of a missing/zero...

9router <=0.5.4 - Authentication Bypass

9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

CVE-2026-123599

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verifyrrsets ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply...

CVE-2026-123563

Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to allocate massive ArrayBuffers, causing...

EUVD-2026-119364

Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset...

CVE-2026-123605 Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name

Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset...

CVE-2026-123605

Hickory DNS versions hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 are vulnerable to a DNSSEC validation bypass . The root cause is that the validator verifies an RRSIG against the DNSKEY of any name found in the Signer's Name field, failing to verify that this name match...

CVE-2026-123605 Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name

Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset...

CVE-2026-123600 Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypass

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an NSEC3 record matching the hashed QNAME. On-path attackers ...

EUVD-2026-119358

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verifyrrsets ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply...

CVE-2026-123599 Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class Records

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verifyrrsets ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply...

CVE-2026-123599

The Hickory DNS project components hickory-proto (before 0.26.0-beta.1) and hickory-net (before 0.26.2) are vulnerable to a DNSSEC validation bypass . The root cause is that the verify_rrsets() function fails to account for DNS classes when partitioning RRsets, allowing non-IN records to skip sig...

CVE-2026-123599 Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class Records

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verifyrrsets ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply...

CVE-2026-123595 Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3

Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side...

CVE-2026-123595

The Hickory DNS validating recursor contains a DNSSEC validation flaw in the NSEC3 handler affecting hickory-proto versions 0.25 through 0.26.0-alpha.1 and hickory-net versions 0.26.0-beta.1 before 0.26.2. The root cause is that the handler matches the closest encloser by hash alone without verif...

CVE-2026-123596 Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC handler that accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names below the zone cut. An on-path...

CVE-2026-123596

The hickory-proto (through 0.26.0-alpha.1) and hickory-net (0.26.0-beta.1 before 0.26.2) components in Hickory DNS contain a DNSSEC validation flaw within the validating recursor's NSEC handler . The vulnerability stems from the handler's acceptance of parent-side ancestor-delegation NSEC records...