Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
122 results · page 1 of 3
Oct 14, 2026Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sizedCVE-2026-101341 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.7
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 1CVE-2026-101339 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.7
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 deCVE-2026-101338 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.7
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes.CVE-2026-101337 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.7
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain oCVE-2026-96273 · Other software · NationalSecurityAgency · reported by VulnCheckMedium 6.8
Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown.
- Product
- ghidra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7CVE-2026-92943 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Critical 9.2
Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic, via a certificate issued for an unrelated hostname by a certificate authority present in the device trust store. To remediate this issue, users should upgrade to version 1.6.1.
- Product
- AWSIoTPythonSDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Sep 10, 2026Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencieCVE-2026-89145 · Other software · flextype · reported by VulnCheckLow 2.4
Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users' browsers when dependency validation fails.
- Product
- flextype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLCVE-2026-19538 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.2
The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS CoCVE-2026-19401 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.2
Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service.
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query.CVE-2026-18916 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlMedium 6.9
Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance.
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026When ranges are used for access control (i.e.CVE-2026-18664 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.2
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled through the MDNSD backenCVE-2026-67858 · Other software · reported by MITREHigh 7.5
Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allows remote attackers to cause a denial of service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client SCVE-2026-42004 · Other software · PowerDNS · reported by security@open-xchange.comLow 3.7
An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away.CVE-2026-40211 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.CVE-2026-40210 · Other software · PowerDNS · reported by security@open-xchange.comMedium 4.8
An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFRCVE-2026-40209 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.CVE-2026-40208 · Other software · PowerDNS · reported by security@open-xchange.comLow 3.7
An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be prodCVE-2026-40011 · Other software · PowerDNS · reported by security@open-xchange.comLow 3.7
An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name.CVE-2026-12490 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.2
When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack whCVE-2026-12246 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 7.2
NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes.
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered triviaCVE-2026-12245 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.7
NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivially by sending a DNS query over a DoT connection, and closing the connection without reading the response.
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with aCVE-2026-12244 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.7
If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading toCVE-2026-33602 · Other software · PowerDNS · reported by security@open-xchange.comMedium 6.5
A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newSeCVE-2026-33599 · Other software · PowerDNS · reported by security@open-xchange.comLow 3.1
A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings. DDR upgrade is not enabled by default.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache.CVE-2026-33598 · Other software · PowerDNS · reported by security@open-xchange.comMedium 4.8
A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026PRSD detection denial of serviceCVE-2026-33597 · Other software · PowerDNS · reported by security@open-xchange.comLow 3.7
PRSD detection denial of service
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed querCVE-2026-33596 · Other software · PowerDNS · reported by security@open-xchange.comLow 3.1
A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed queries that are routed to a TCP-only or DNS over TLS backend.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not propeCVE-2026-33595 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate intoCVE-2026-33594 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released until the end of the connection.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.CVE-2026-33593 · Other software · PowerDNS · reported by security@open-xchange.comHigh 7.5
A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service.CVE-2026-33254 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service. DOQ and DoH3 are disabled by default.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua codeCVE-2026-27854 · Other software · PowerDNS · reported by security@open-xchange.comMedium 4.8
An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code. In some cases DNSQuestion:getEDNSOptions might refer to a version of the DNS packet that has been modified, thus triggering a use-after-free and potentially a crash resulting in denial of service.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeCVE-2026-27853 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.9
An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code. In some cases the rewritten packet might become larger than the initial response and even exceed 65535 bytes, potentially leading to a crash resulting in denial of service.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of CVE-2026-24030 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly closed, but in some cases the system might enter an out-of-memory state instead and terminate the process.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is CVE-2026-24029 · Other software · PowerDNS · reported by security@open-xchange.comMedium 6.5
When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS CVE-2026-24028 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of service, or access unrelated memory, leading to potential information disclosure.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a maliciCVE-2026-0397 · Other software · PowerDNS · reported by security@open-xchange.comLow 3.1
When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamicCVE-2026-0396 · Other software · PowerDNS · reported by security@open-xchange.comLow 3.1
An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain.CVE-2026-22866 · Other software · ensdomains · reported by GitHubLow 2.7
Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. In versions 1.6.2 and prior, the `RSASHA256Algorithm` and `RSASHA1Algorithm` contracts fail to validate PKCS#1 v1.5 padding structure when verifying RSA signatures. The contracts only check if the last 32 (or 20) bytes of the decrypted signature match the expected hash. This enables Bleichenbacher's 2006 signature forgery attack against DNS zones using RSA keys with low public exponents (e=3). Two ENS-supported TLDs (.cc and .name) use e=3 for their Key Signing Keys, allowing any domain under these TLDs to be fraudulently claimed on ENS without DNS ownership. Apatch was merged at commit c76c5ad0dc9de1c966443bd946fafc6351f87587. Possible workarounds include deploying the patched contracts and pointing DNSSECImpl.setAlgorithm to the deployed contract.
- Product
- ens-contracts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a deCVE-2025-30187 · Other software · PowerDNS · reported by security@open-xchange.comLow 3.7
In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddnsdist.orgopenwall.com
May 20, 2025In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can caCVE-2025-30193 · Other software · PowerDNS · reported by security@open-xchange.comHigh 7.5
In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can cause a denial of service by crafting a TCP exchange that triggers an exhaustion of the stack and a crash of DNSdist, causing a denial of service. The remedy is: upgrade to the patched 1.9.10 version. A workaround is to restrict the maximum number of queries on incoming TCP connections to a safe value, like 50, via the setMaxTCPQueriesPerConnection setting. We would like to thank Renaud Allard for bringing this issue to our attention.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegaCVE-2025-30194 · Other software · PowerDNS · reported by security@open-xchange.comHigh 7.5
When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access (double-free) and crash of DNSdist, causing a denial of service. The remedy is: upgrade to the patched 1.9.9 version. A workaround is to temporarily switch to the h2o provider until DNSdist has been upgraded to a fixed version. We would like to thank Charles Howes for bringing this issue to our attention.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddnsdist.orgopenwall.com
Nov 26, 2024A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps.CVE-2024-9929 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 4.3
A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps.
- Product
- NSD570 Teleprotection Equipment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Nov 26, 2024A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts.CVE-2024-9928 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 5.3
A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause account takeover and unauthorized access to the system when an attacker conducts brute-force attacks against the equipment login. Note that the system supports only one concurrent session and implements a delay of more than a second between failed login attempts making it difficult to automate the attacks.
- Product
- NSD570 Teleprotection Equipment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
May 14, 2024When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can triggeCVE-2024-25581 · Other software · PowerDNS · reported by security@open-xchange.comHigh 7.5
When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, causing the process to stop and thus leading to a Denial of Service. DNS over HTTPS is not enabled by default, and backends are using plain DNS (Do53) by default.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comdnsdist.org
May 2, 2024Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2023-42119 · Other software · Exim · reported by zdi-disclosures@trendmicro.comLow 3.1
Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. . Was ZDI-CAN-17643.
- Product
- Exim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comlists.debian.org
Jan 11, 2024 A Heap-based Buffer Overflow vulnerability in the Network Services Daemon (NSD) of Juniper Networks Junos OS allows authenticated, low privileged, local attackCVE-2024-21594 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 5.5
A Heap-based Buffer Overflow vulnerability in the Network Services Daemon (NSD) of Juniper Networks Junos OS allows authenticated, low privileged, local attacker to cause a Denial of Service (DoS). On an SRX 5000 Series device, when executing a specific command repeatedly, memory is corrupted, which leads to a Flow Processing Daemon (flowd) crash. The NSD process has to be restarted to restore services. If this issue occurs, it can be checked with the following command: user@host> request security policies check The following log message can also be observed: Error: policies are out of sync for PFE node<number>.fpc<number>.pic<number>. This issue affects: Juniper Networks Junos OS on SRX 5000 Series * All versions earlier than 20.4R3-S6; * 21.1 versions earlier than 21.1R3-S5; * 21.2 versions earlier than 21.2R3-S4; * 21.3 versions earlier than 21.3R3-S3; * 21.4 versions earlier than 21.4R3-S3; * 22.1 versions earlier than 22.1R3-S1; * 22.2 versions earlier than 22.2R3; * 22.3 versions earlier than 22.3R2.
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.netfirst.org
Dec 19, 2023A use-after-free was identified in the `nsDNSService::Init`.CVE-2023-6862 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Oct 13, 2023Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings.CVE-2023-45465 · Other software · netis-systems · reported by MITRECritical 9.8
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings.
- Product
- n3m
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2023Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain.CVE-2023-38698 · Other software · ensdomains · reported by GitHubMedium 4.9
Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the expiration time of existing domains due to an integer overflow in the renew function. The vulnerability resides `@ensdomains/ens-contracts` prior to version 0.0.22. If successfully exploited, this vulnerability would enable attackers to force the expiration of any ENS record, ultimately allowing them to claim the affected domains for themselves. Currently, it would require a malicious DAO to exploit it. Nevertheless, any vulnerability present in the controllers could potentially render this issue exploitable in the future. An additional concern is the possibility of renewal discounts. Should ENS decide to implement a system that offers unlimited .eth domains for a fixed fee in the future, the vulnerability could become exploitable by any user due to the red
- Product
- ens-contracts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.