Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 263 total.
Stack Buffer Overflow in Unbound EDNS Report-Channel Processing (CVE-2026-55973)
When 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from an upstream response is processed, using the option's length as the length of the agent domain. If the agent domain is followed by ...
Fixed in 1.25.2
Cross-zone wildcard cache poisoning in Unbound (CVE-2026-44690)
Insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning in Unbound. A malicious actor controlling a single delegated z...
Fixed in 1.25.2
Heap Overflow in Unbound DNSCrypt TCP Handling (CVE-2026-40691)
A heap overflow vulnerability exists in Unbound when compiled with DNSCrypt support. A malicious DNSCrypt query over TCP causes the reply encryption routine to fail to bound the reply length against the destination bu...
Fixed in 1.25.2
Memory accounting bypass in Unbound downstream DoQ implementation (CVE-2026-32665)
In NLnet Labs Unbound versions 1.22.0 through 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection bypass the per-stream 'quic-size' gate, allowing a rem...
Fixed in 1.25.2
SSO Instance-Role Provisioning Privilege Escalation in n8n (CVE-2026-65016)
n8n's Enterprise SSO instance-role provisioning does not prevent assignment of the global:owner role, allowing an SSO-authenticated user with a controlled instance-role claim to escalate privileges to instance owner. ...
Fixed in 1.123.64; 2.29.8; 2.30.1
Privilege Escalation via profile self-update in Grav Login plugin (CVE-2026-65603)
The Grav Login plugin versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler. Unlike the registration handler, it does not strip privilege fields ('groups','access') fr...
Fixed in 3.8.12
Local Privilege Escalation in Pi-hole via /etc/pihole/logrotate (CVE-2026-50130)
Pi-hole is a DNS sinkhole that protects devices from unwanted content. From version 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate, whi...
Fixed in 6.4.3
Out-of-bounds read in YAML::Syck for Perl (CVE-2026-57077)
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. A...
Fixed in 1.47
Negative chunk-size DoS in cpp-httplib (CVE-2026-45352)
A negative chunk-size in HTTP chunked Transfer-Encoding causes cpp-httplib to misinterpret the chunk size, leading to unbounded memory allocation and process crash. An unauthenticated remote attacker can exploit this ...
Fixed in 0.43.4
Authentication bypass and remote code execution in FUXA (CVE-2026-43945)
FUXA contains a path confusion flaw in its authentication middleware that allows unauthenticated remote attackers to bypass security checks by appending `?x=/socket.io` to requests targeting protected `/nodered/*` end...
Fixed in >= 1.3.1
Authorization bypass in FUXA /api/getTagValue endpoint (CVE-2026-43946)
An authorization bypass vulnerability in the FUXA SCADA/HMI platform allows unauthenticated users to retrieve arbitrary tag values via the /api/getTagValue endpoint. The flaw arises because the authorization check isA...
Fixed in >= 1.3.1
Unauthenticated remote code execution in FUXA via script test mode (CVE-2026-43947)
An authorization confused deputy vulnerability in FUXA allows unauthenticated attackers to execute arbitrary code on the server. The `POST /api/runscript` endpoint validates permissions against a stored script's ID, b...
Fixed in >= 1.3.1
Heap information disclosure in libheif grid image decoding (CVE-2026-47247)
Two chained bugs in libheif allow an attacker to leak process heap memory as visible pixel values in decoded grid images. An uninitialized pixel plane allocation (pixelimage.cc:684) combined with an integer-division g...
Fixed in v1.22.0
ByteBuf reference leak in Netty SpdyHttpDecoder causes native memory exhaustion (CVE-2026-56745)
The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec fails to release a pooled `ByteBuf` when a stream is terminated via `RST_STREAM` or when accumulated content exceeds `maxContentLength`, permanently leaking ...
Fixed in 4.2.16.Final; 4.1.136.Final
Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling (CVE-2026-10680)
The Classic Bluetooth (BR/EDR) L2CAP signaling handlers `l2cap_br_conf_req()` and `l2cap_br_conf_rsp()` in Zephyr incorrectly validate the per-command data length against the full PDU buffer length (`buf->len`) rather...
Fixed in 4.3.1; 4.5.0
NULL-pointer and out-of-bounds write in Zephyr MCTP I2C+GPIO target binding (CVE-2026-10678)
The MCTP-over-I2C+GPIO target binding in Zephyr fails to validate receive buffer allocation and bounds before writing in mctp_i2c_gpio_target_write_received(). An unauthenticated I2C bus controller can trigger a NULL-...
Fixed in 4.5.0
Unbounded memory exhaustion in Netty HAProxyMessageDecoder (CVE-2026-55851)
A signed-byte sentinel collision in Netty's `HAProxyMessageDecoder` (`codec-haproxy` module) causes the decoder to enter a perpetual version-detection loop when a PROXY protocol v2 stream contains version byte `0xFF`....
Fixed in 4.2.16.Final; 4.1.136.Final
Server-side request forgery in Gitea hostmatcher and OpenID sign-in (CVE-2026-58314)
Gitea's IP classifier in the `hostmatcher` module fails to block ten address families including CGNAT (100.64.0.0/10), allowing any authenticated user to direct webhook deliveries or repository migrations to internal ...
Fixed in 1.27.0
Quadratic-time denial of service in Gitea Locale middleware (CVE-2026-58436)
Gitea's Locale middleware passes the raw `Accept-Language` HTTP header to `golang.org/x/text/language.ParseAcceptLanguage` without imposing a size or character-class filter. The existing CVE-2022-32149 guard caps hyph...
Fixed in 1.27.0
Uncontrolled recursion denial of service in Net::DNS for Perl (CVE-2026-64194)
Net::DNS versions through 1.55 for Perl contain an uncontrolled recursion vulnerability in `Net::DNS::DomainName::decode`, which follows RFC 1035 DNS compression pointers without enforcing a depth limit. A remote atta...
Fixed in 1.56