5419 matches found
CVE-2026-46624 Twenty: SQL Injection via the timeZone field
Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution RCE vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the...
CVE-2026-42923
A flaw was found in Unbound's DNSSEC validator where the code path for consulting the negative cache for DS records does not honor the limit on NSEC3 hash calculations introduced in version 1.19.1. An adversary who controls a DNSSEC-signed zone can sign NSEC3 records with high iteration counts fo...
WordPress Car Zone theme <= 3.7 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Car Zone versions = 3.7...
CVE-2026-3592
A flaw was found in BIND resolvers. A remote attacker could exploit this vulnerability by sending a query to a specially crafted zone. This would cause the resolver to consume disproportionate resources, leading to a denial of service DoS due to resource exhaustion. Mitigation Mitigation for this...
Fedora 43 : bind / bind-dyndb-ldap (2026-b626e83a45)
The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-b626e83a45 advisory. Update to 9.18.49 rhbz2480121 Security Fixes: - Limit resolver server list size. CVE-2026-3592 - Fix GSS-API resource leak. CVE-2026-3039 - Disable...
Fedora 44 : bind / bind-dyndb-ldap (2026-411248c8d9)
The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-411248c8d9 advisory. Update to 9.18.49 rhbz2480121 Security Fixes: - Limit resolver server list size. CVE-2026-3592 - Fix GSS-API resource leak. CVE-2026-3039 - Disable...
unbound: Unbound: Cache manipulation via 'ghost domain names' attack
A flaw was found in NLnet Labs Unbound. A remote attacker, by controlling a malicious domain a "ghost zone" and querying a vulnerable Unbound server, could exploit a vulnerability related to "ghost domain names" attacks. This could allow the attacker to overwrite cached Name Server NS records,...
CLSA-2026-1779534149 unbound: Fix of CVE-2026-33278
CVE-2026-33278: use-after-free in DNSSEC validator dnsmsgdeepcopyregion during NSEC3 sub-query suspend/resume; buggy struct-assignment overwrote the destination's freshly-allocated rrsets pointer with the source's pointer, leaving a dangling pointer dereferenced after the source region was freed...
SUSE CVE-2026-42000
Insufficient Validation of Names During AXFR...
SUSE CVE-2026-42396
Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail...
bind: Amplification vulnerabilities via self-pointed glue records
A flaw was found in BIND resolvers. A remote attacker could exploit this vulnerability by sending a query to a specially crafted zone. This would cause the resolver to consume disproportionate resources, leading to a denial of service DoS due to resource exhaustion...
CVE-2026-42396
Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail...
CVE-2026-42000
Insufficient Validation of Names During AXFR...
CVE-2026-42000 Insufficient Validation of Names During AXFR
Insufficient Validation of Names During AXFR...
CVE-2026-42000
Insufficient Validation of Names During AXFR...
CVE-2026-42000 Insufficient Validation of Names During AXFR
Insufficient Validation of Names During AXFR...
CVE-2026-42000
Insufficient Validation of Names During AXFR...
CVE-2026-42000
CVE-2026-42000 affects PowerDNS Authoritative server. The issue is "Insufficient Validation of Names During AXFR" in the AXFR process, caused by inadequate validation of transfer names, which is reported to enable a command-injection path per some sources and could contribute to denial of service...
