Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the DomainZones.add process. An attacker can inject unauthorized DNS resource...

Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

Froxlor's DomainZones.add API command accepts user-controlled DNS record and type values and later writes them into generated BIND zone files without rejecting line delimiters, tab characters, or zone-file comment delimiters. The stronger variant is in record. An authenticated customer with...

CVE-2026-54543

In Froxlor before 2.3.8, an authenticated customer with DNS-zone permissions can inject crafted record or type field values (line delimiters, tabs, semicolons) into lib/Froxlor/Api/Commands/DomainZones.php, which DnsEntry.php serializes into a BIND zone file, creating extra resource-record lines ...

CVE-2026-54543 Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

CVE-2026-54543 Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

EUVD-2026-61217

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

CVE-2026-54543 Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

CVE-2026-50248

A flaw in Unbound allows a remote attacker to replace an authenticated or Response Policy Zone RPZ by spoofing DNS records for configured primary hostnames. This enables the attacker to impersonate the primary server, leading to DNS cache poisoning or traffic redirection. Mitigation Configure...

ANT-2026-S8PHCV74 · cloudfoundry/uaa · auth_bypass

auth-bypass medium Severity Claude high · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-S8PHCV74: DenyAccessToUaaAdvice case-sensitive check bypassed on MySQL: zones.write overwrites syste...

CVE-2026-54543: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

Linux Distros Unpatched Vulnerability : CVE-2026-72247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconncount: fix zone comparison in tuple dedup The already exists dedup logic in nfconncountadd decides whether a connection has already been counte...

PT-2026-77301

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes

A flaw was found in Unbound. Insufficient validation of the RRSIG.Labels field, combined with premature cache writes during RFC 8198 aggressive NSEC processing, can lead to cache poisoning. This vulnerability allows a malicious actor, controlling a single delegated zone, to poison arbitrary sibli...

CVE-2026-71194

A flaw was found in the OpenStack Designate mDNS NOTIFY handler. The handlenotify method performs zone lookups without poolid scoping, unlike the QUERY and AXFR handlers which were previously updated to be pool-aware. When zones with the same name exist across different DNS pools, the storage lay...

CVE-2026-71193

A flaw was found in OpenStack Designate. When the AttributeFilter scheduler is enabled with multiple DNS pools, an authenticated tenant can bypass zone ownership checks by scheduling a zone to a different pool. The database uniqueness constraint on zone names is pool-scoped, and the...

CVE-2026-72247

A flaw was found in the Linux kernel's netfilter nfconncount component. An incorrect comparison of conntrack zones in the connection counting logic can cause different zones to be treated as equal. This miscalculation in connection deduplication may lead to connection limits not being properly...

CVE-2026-16139

Progress ShareFile Storage Zones Controller ≤5.12.5 and ≤6.0.2 suffer path-traversal in the download preparation flow, allowing an authenticated zone admin to write files outside the intended directory. RCE is confirmed in v5 but unconfirmed in v6. No patch version is specified in the provided do...

CVE-2026-18674

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18674

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

EUVD-2026-60160

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...