EUVD-2026-47679

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the contro...

CVE-2026-55708 Privacy/configuration issue when adding local data in views through 'unbound-control'

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the contro...

CVE-2026-55708

NLnet Labs Unbound v1.6.0–1.25.1 is affected. The vulnerability stems from the view_local_data and view_local_datas commands in unbound-control, which can create a bare local zones tree for an already configured named view when the view starts without local data. The created tree omits default-pr...

CVE-2026-55708 Privacy/configuration issue when adding local data in views through 'unbound-control'

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the contro...

CVE-2026-55708

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the contro...

CVE-2026-52863

In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure...

CVE-2026-52863 Memory corruption could lead to crash and denial of service

In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure...

CVE-2026-52863

In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure...

CVE-2026-52863

The CVE concerns NLnet Labs Unbound 1.25.0–1.25.1. A fix that enables coexistence of the respip and dns64 modules creates a shallow copy of the view name, which, under pressure when a configured access-control-view is active and subqueries (respip CNAME redirection, dns64, subnetcache) are attach...

EUVD-2026-47677

In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure...

PT-2026-63387

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.6.0 through 1.25.1 Description The view local data and view local datas commands of unbound-control create a bare local zones tree for a configured named view that initially contains no local data. This process...

PT-2026-63484

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description An off-by-one error exists in the code used to parse MIME headers Multipurpose Internet Mail Extensions for display when forwarding a message, specifically when...

CVE-2026-52863: Use After Free

In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure...

PT-2026-63464

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with limited read privileges can access documents from collections they are not authorized to read. This occurs because of an inconsistency...

CVE-2026-13060: Incorrect Authorization

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections...

PT-2026-63385

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.25.0 through 1.25.1 Description A memory corruption issue exists when the software is under pressure and configured with an access-control-view and either the respip or rpz modules, alongside a module capable of...

EUVD-2026-44506

jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization...

GHSA-5GVW-P9QM-JGWH jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

Summary UnwrappedPropertyHandler.processUnwrapped replays the buffered JSON for a @JsonUnwrapped property by iterating its properties and calling prop.deserializeAndSet with no prop.visibleInViewctxt.getActiveView guard — the exact guard processUnwrappedCreatorProperties received in the 5971 /...

jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

Summary UnwrappedPropertyHandler.processUnwrapped replays the buffered JSON for a @JsonUnwrapped property by iterating its properties and calling prop.deserializeAndSet with no prop.visibleInViewctxt.getActiveView guard — the exact guard processUnwrappedCreatorProperties received in the 5971 /...

EUVD-2026-46407

djangoSIGE through 1.10 commit a6fe7e8 contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can...