5723 matches found
CVE-2026-72247
A flaw was found in the Linux kernel's netfilter nfconncount component. An incorrect comparison of conntrack zones in the connection counting logic can cause different zones to be treated as equal. This miscalculation in connection deduplication may lead to connection limits not being properly...
CVE-2026-16139
Progress ShareFile Storage Zones Controller ≤5.12.5 and ≤6.0.2 suffer path-traversal in the download preparation flow, allowing an authenticated zone admin to write files outside the intended directory. RCE is confirmed in v5 but unconfirmed in v6. No patch version is specified in the provided do...
CVE-2026-18674
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...
CVE-2026-18674
Kong Mesh multi-zone deployments are vulnerable in the zone-to-global KDS sync: the global control plane trusts an in-band, sender-controlled ControlPlane.Identifier instead of the authenticated TLS zone identity. This allows any authenticated zone to inject, attribute, and overwrite resources in...
CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...
CVE-2026-18674
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...
CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...
EUVD-2026-60160
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...
CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...
CVE-2026-49306
UAF vulnerability in the time and time zone module. Impact: Successful exploitation of this vulnerability may affect availability...
EUVD-2026-60072
UAF vulnerability in the time and time zone module. Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2026-49306
UAF vulnerability in the time and time zone module. Impact: Successful exploitation of this vulnerability may affect availability...
bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...
bind: bind9: Incorrect acceptance of NSEC3 records
BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...
bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...
CVE-2026-16139: Improper Limitation of a Pathname to a Restricted Directory
In Progress ShareFile Storage Zones Controller versions = 5.12.5 and = 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote...
CVE-2026-18674: Insufficient Verification of Data Authenticity
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...
unbound security update
1.24.2-18 - Add unit tests for CVE-2026-44690,55973 1.24.2-17 - Fix CVE-2026-55973: dns-error-reporting stack buffer overflow 1.24.2-16 - Fix CVE-2026-44690 - Cross-zone wildcard cache poisoning...
PT-2026-76636
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...