Latest CVEs

CVE-2026-114713 - UnrealIRCd IRCv3 Label Message Tag Command Injection
Published: November 08, 2026
CVE ID :CVE-2026-114713
Published : Nov. 8, 2026, 3:16 a.m. | 2 hours, 13 minutes ago
Description :The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
Severity: 8.6 | HIGH

CVE-2026-124422 - SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder
Published: November 08, 2026
CVE ID :CVE-2026-124422
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.
Severity: 6.1 | MEDIUM

CVE-2026-123616 - imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loader
Published: November 08, 2026
CVE ID :CVE-2026-123616
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger memory exhaustion and worker crashes without authentication.
Severity: 8.7 | HIGH

CVE-2026-123615 - imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader
Published: November 08, 2026
CVE ID :CVE-2026-123615
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker.
Severity: 8.7 | HIGH

CVE-2026-123614 - imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow
Published: November 08, 2026
CVE ID :CVE-2026-123614
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.
Severity: 9.8 | CRITICAL

CVE-2026-123613 - Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass
Published: November 08, 2026
CVE ID :CVE-2026-123613
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.
Severity: 6.9 | MEDIUM

CVE-2026-123612 - rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure
Published: November 08, 2026
CVE ID :CVE-2026-123612
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server.
Severity: 4.6 | MEDIUM

CVE-2026-123611 - rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHello
Published: November 08, 2026
CVE ID :CVE-2026-123611
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later ClientHellos to send only classical shares and lose post-quantum confidentiality.
Severity: 6.3 | MEDIUM

CVE-2026-123610 - rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression
Published: November 08, 2026
CVE ID :CVE-2026-123610
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.
Severity: 6.3 | MEDIUM

CVE-2026-123609 - Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug
Published: November 08, 2026
CVE ID :CVE-2026-123609
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.
Severity: 4.1 | MEDIUM

CVE-2026-123608 - Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression
Published: November 08, 2026
CVE ID :CVE-2026-123608
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.
Severity: 8.7 | HIGH

CVE-2026-123607 - Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service
Published: November 08, 2026
CVE ID :CVE-2026-123607
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. Upstream attackers can return NoData or NXDomain responses with a cross-zone SOA record to panic debug builds or exhaust memory in release builds.
Severity: 8.7 | HIGH

CVE-2026-123606 - Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification
Published: November 08, 2026
CVE ID :CVE-2026-123606
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.
Severity: 8.7 | HIGH

CVE-2026-123605 - Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name
Published: November 08, 2026
CVE ID :CVE-2026-123605
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset. Attackers controlling any secure zone can produce valid signatures over arbitrary records in unrelated zones, which resolvers, recursors, and clients using DnssecDnsHandle accept as authenticated.
Severity: 8.8 | HIGH

CVE-2026-123604 - Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loop
Published: November 08, 2026
CVE ID :CVE-2026-123604
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.
Severity: 8.7 | HIGH

CVE-2026-123603 - Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass
Published: November 08, 2026
CVE ID :CVE-2026-123603
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.
Severity: 6.9 | MEDIUM

CVE-2026-123602 - Hickory DNS Recursor Ghost Domain Attack via Child-Side NS RRset Caching
Published: November 08, 2026
CVE ID :CVE-2026-123602
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a zone's NS records, an attacker keeps the stale RRset cached indefinitely, letting name servers whose delegation the parent revoked keep answering for the zone.
Severity: 8.2 | HIGH

CVE-2026-123601 - Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery
Published: November 08, 2026
CVE ID :CVE-2026-123601
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the wrap-around branch of find_covering_record() in nsec3.rs, so the last NSEC3 record in a zone's hash ring covers every hash except its owner. Attackers able to inject DNS responses can replay that NSEC3 record and its RRSIG to forge DNSSEC-validated negative responses denying legitimate names.
Severity: 8.3 | HIGH

CVE-2026-123600 - Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypass
Published: November 08, 2026
CVE ID :CVE-2026-123600
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an NSEC3 record matching the hashed QNAME. On-path attackers or malicious authoritative servers can replay a validly signed non-apex NSEC3 with the zone's signed SOA to serve an authenticated (AD=1) denial of any apex RRtype for the negative-cache TTL.
Severity: 6.3 | MEDIUM

CVE-2026-123599 - Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class Records
Published: November 08, 2026
CVE ID :CVE-2026-123599
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.
Severity: 6.3 | MEDIUM

CVE-2026-123598 - Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning
Published: November 08, 2026
CVE ID :CVE-2026-123598
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.
Severity: 6.3 | MEDIUM

CVE-2026-123597 - Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors
Published: November 08, 2026
CVE ID :CVE-2026-123597
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a child-zone DS sub-query causes the validator to return SERVFAIL for all names under that zone until the cache entry's TTL expires.
Severity: 6.3 | MEDIUM

CVE-2026-123596 - Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC
Published: November 08, 2026
CVE ID :CVE-2026-123596
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC handler that accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names below the zone cut. An on-path attacker, rogue parent nameserver, or attacker winning a port and TXID race can deliver one forged NXDOMAIN response built from genuinely signed parent NSEC records, causing authenticated denial of existing child-zone names cached for the negative TTL.
Severity: 8.8 | HIGH

CVE-2026-123595 - Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3
Published: November 08, 2026
CVE ID :CVE-2026-123595
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut.
Severity: 8.8 | HIGH

CVE-2026-123594 - Hickory DNS through 0.26.0-alpha.1 DNSSEC NSEC Validation Bypass for Empty Non-Terminals
Published: November 08, 2026
CVE ID :CVE-2026-123594
Published : Nov. 8, 2026, 2:16 a.m. | 3 hours, 12 minutes ago
Description :Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain an NSEC validation flaw that returns a secure proof for NXDOMAIN responses when the covering NSEC's Next Domain Name is a strict descendant of the query name, which actually proves the name exists as an empty non-terminal. On-path attackers can flip the unsigned rcode of a genuine signed NODATA response from NOERROR to NXDOMAIN, causing validators to accept forged nonexistence of the name.
Severity: 6.3 | MEDIUM