CVE-2026-26081 HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
Information published.
EPSS 0.00 CVE-2026-26081 HAProxy US
Výsledky hledání
32
CVE-2026-26080 HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.
Information published.
EPSS 0.01 CVE-2026-26080 HAProxy US
CVE-2026-63308 Helm Files.Lines Denial of Service via Empty Chart Files
Information published.
EPSS 0.00 CVE-2026-63308 US
CVE-2026-50243 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL
Information published.
EPSS 0.00 CVE-2026-50243 US
CVE-2026-41637 Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries
Information published.
EPSS 0.00 CVE-2026-41637 US
CVE-2026-50252 Possible cache poisoning attack by mapping source port population per thread
Information published.
EPSS 0.00 CVE-2026-50252 US
CVE-2026-50251 Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush
Information published.
EPSS 0.00 CVE-2026-50251 US
CVE-2026-55991 Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
Information published.
EPSS 0.00 CVE-2026-55991 libngtcp2 US
CVE-2026-55990 Packet of death for a DNSCrypt misconfigured Unbound
Information published.
EPSS 0.00 CVE-2026-55990 Unbound US
CVE-2026-50046 Possible heap use-after-free in an error path when a DoT forwarded query is jostled out
Information published.
EPSS 0.00 CVE-2026-50046 US
CVE-2026-14586 Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments
Information published.
EPSS 0.00 CVE-2026-14586 US
CVE-2026-46582 A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path
Information published.
EPSS 0.00 CVE-2026-46582 US
CVE-2026-54478 DNS Cookie bypass when combined with proxy-protocol use
Information published.
EPSS 0.00 CVE-2026-54478 US
CVE-2026-56444 Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration
Information published.
EPSS 0.00 CVE-2026-56444 US
CVE-2026-32665 Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass
Information published.
EPSS 0.00 CVE-2026-32665 US
CVE-2026-40691 Packet of death for DNSCrypt over TCP
Information published.
EPSS 0.00 CVE-2026-40691 US
CVE-2026-55717 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash
Information published.
EPSS 0.00 CVE-2026-55717 US
CVE-2026-44621 Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated
Information published.
EPSS 0.00 CVE-2026-44621 Libunbound US
CVE-2026-56416 Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name
Information published.
EPSS 0.00 CVE-2026-56416 US
CVE-2026-52863 Memory corruption could lead to crash and denial of service
Information published.
EPSS 0.00 CVE-2026-52863 US
CVE-2026-55708 Privacy/configuration issue when adding local data in views through 'unbound-control'
Information published.
EPSS 0.00 CVE-2026-55708 US
CVE-2026-44690 Cross-zone wildcard cache poisoning via RRSIG.labels manipulation
Information published.
EPSS 0.00 CVE-2026-44690 US
CVE-2026-50248 BOGUS configured primary hostname accepted for XFR in auth/rpz zones
Information published.
EPSS 0.00 CVE-2026-50248 US
CVE-2026-50045 'max-global-quota' reset by DNSSEC validation restarts
Information published.
EPSS 0.00 CVE-2026-50045 US
CVE-2026-44687 Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN
Information published.
EPSS 0.00 CVE-2026-44687 US
CVE-2026-55973 'dns-error-reporting: yes' leads to stack buffer overflow
Information published.
EPSS 0.00 CVE-2026-55973 US
CVE-2026-53910 Heap-based Buffer Overflow in GNU diffutils
Information published.
EPSS 0.00 CVE-2026-53910 GNU US PL 2 zdrojů
CVE-2026-62994 CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
Information published.
EPSS 0.00 CVE-2026-62994 US
CVE-2026-63136 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Information published.
EPSS 0.00 CVE-2026-63136 Elasticsearch US
CVE-2026-63263 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Information published.
EPSS 0.00 CVE-2026-63263 Elasticsearch US
CVE-2026-63140 Reachable Assertion in Elasticsearch Leading to Denial of Service
Information published.
EPSS 0.00 CVE-2026-63140 Elasticsearch US
CVE-2026-56145 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Information published.
EPSS 0.00 CVE-2026-56145 Elasticsearch US
4
CVE-2026-39879 SQL injection in syslog-ng SQL destionation driver
Information published.
EPSS 0.00 CVE-2026-39879 syslog-ng US
CVE-2026-26199 Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero
Information published.
EPSS 0.00 CVE-2026-26199 US
CVE-2026-26197 Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c
Information published.
EPSS 0.00 CVE-2026-26197 US
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2026-50522)
CISA added CVE-2026-50522 to the Known Exploited Vulnerabilities catalog. Affected product: Microsoft SharePoint. Remediation due date: 2026-07-25.
KEV ✓ EPSS 0.85 CVSS 8.1 CVE-2026-50522 Microsoft veřejná správa US 3 zdrojů
5
CVE-2026-42770 FFC-DH Peer Validation Uses Attacker-Supplied q
Information published.
EPSS 0.00 CVE-2026-42770 US
CVE-2026-38752 A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
Information published.
EPSS 0.00 CVE-2026-38752 BusyBox US
CVE-2026-38753 A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
Information published.
EPSS 0.00 CVE-2026-38753 Busybox US
ZDI-26-445: Microsoft Windows WMI Providers Incorrect Authorization Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2026-50325.
EPSS 0.00 CVSS 7.0 CVE-2026-50325 Microsoft US 2 zdrojů
ZDI-26-446: Microsoft Windows WMI Providers Incorrect Authorization Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2026-50297.
EPSS 0.00 CVSS 7.0 CVE-2026-50297 Microsoft US 2 zdrojů
1
CVE-2026-62389 ws < 8.21.1 Default maxFragments Allows Memory Exhaustion DoS
Information published.
4
CVE-2026-56434 NGINX ngx_http_ssi_module vulnerability
Information published.
EPSS 0.00 CVE-2026-56434 NGINX US
CVE-2026-42533 NGINX Map directive and Regex matching vulnerability
Information published.
EPSS 0.04 CVE-2026-42533 NGINX US
CVE-2026-38755 A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
Information published.
EPSS 0.00 CVE-2026-38755 BusyBox US
CVE-2026-38754 A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
Information published.
EPSS 0.00 CVE-2026-38754 Busybox US
6
CVE-2026-59884 pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
Information published.
EPSS 0.00 CVE-2026-59884 pyasn1 US
CVE-2026-60081 DBI::ProfileData versions before 1.651 for Perl do not limit the path index
Information published.
EPSS 0.00 CVE-2026-60081 US
CVE-2026-15392 DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location
Information published.
EPSS 0.00 CVE-2026-15392 US
CVE-2026-60082 DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row
Information published.
EPSS 0.00 CVE-2026-60082 US
CVE-2026-15043 DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text
Information published.
EPSS 0.00 CVE-2026-15043 DBI::SQL::Nano US
CVE-2026-57433 Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record
Information published.
EPSS 0.00 CVE-2026-57433 US
4
CVE-2026-56171 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-56171 US
CVE-2026-58598 Windows Backup Service Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-58598 US
CVE-2026-59117 Windows Terminal Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-59117 US
CVE-2026-58643 Windows Admin Center Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-58643 US
4
CVE-2026-59831 GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace
Information published.
EPSS 0.00 CVE-2026-59831 GitHub US
CVE-2026-42505 Invoking Encrypted Client Hello privacy leak in crypto/tls
Information published.
EPSS 0.00 CVE-2026-42505 US
CVE-2026-39822 Root escape via symlink plus trailing slash in os
Information published.
EPSS 0.00 CVE-2026-39822 US
CVE-2026-13221 Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk
Information published.
EPSS 0.00 CVE-2026-13221 Perl US