Remote code execution in CoffeeZip v4.8.0.0 allows attackers to achieve full system compromise via a crafted archive file. The flaw requires user interaction, with no authentication needed, and has a CVSS score of 8.8 but low EPSS (0.22%) and no evidence of active exploitation.
Remote code execution in NCH ExpressZip v11.29 allows attackers to execute arbitrary code by convincing a user to open a crafted archive file. The vulnerability is a protection mechanism failure (CWE-693) with no authentication required and user interaction needed. No active exploitation or public exploit is confirmed at this time.
Database corruption or site takeover in DB Replacer extension for Joomla versions 1.0.0 through 8.2.7 allows unauthorized backend users or CSRF attacks to perform database replacements, risking major data corruption. The vulnerability arises from inconsistent enforcement of Super User permission and CSRF token validation on administrative routes and replacement requests. No public exploit has been identified at time of analysis, and EPSS estimates a low 0.2% probability of exploitation.
Heap buffer overflow (out-of-bounds write) in FFmpeg's VobSub subtitle demuxer lets an attacker corrupt adjacent heap memory and potentially achieve arbitrary code execution in any application that links FFmpeg's libavformat and processes a malicious .sub/.idx file. All releases from 2.1 through 8.1.2 are affected. A vendor patch exists (commit dbd495f) and the issue was reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
We are tasked with generating a JSON analysis for CVE-2026-63280. We have the description, CVSS, CWE, EPSS, SSVC, tags, affected products, references. Need to synthesize all. Let's break down the input: - CVE: CVE-2026-63280 - Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." - CVSS: 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE: CWE-352 (Cross-Site Request Forgery) - EPSS: 0.13% (percentile 3%) - Reported by: Joomla - CPE: multiple from regularlabs.com for extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, Rereplacer Pro) for Joomla. - Tags: CSRF, and the extension names. - SSVC: Exploitation: none, Automatable: no, Technical Impact: total - ENISA EUVD-ID: EUVD-2026-47812 - Affected versions from EUVD: listed for each extension. - References: [cveorg] (None) https://regularlabs.com/ ... maybe missing advisory? Only link to vendor homepage. No specific advisory. So patch status unclear. We need to produce a comprehensive analysis. First, product_name: The vulnerability affects multiple extensions from Regular Labs for Joomla. The primary affected product is a set of extensions, but we need to pick a concise name. Could be "Regular Labs Joomla extensions" or the specific one? Since it's multiple, maybe "Advanced Module Manager" or one of them. Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." That sounds like CSRF and permission issues in the admin interface of these extensions. From tags: CSRF. So likely a CSRF vulnerability in all these extensions. The CWE is CWE-352, consistent. Product name: I'll pick "Regular Labs Joomla Extensions" but that might be 3 words. Alternatively, the primary extension mentioned first in tags: "Advanced Module Manager Extension For Joomla" but that's many words. I'll go with "Regular Labs Extensions" (2 words) or "Regular Labs for Joomla"? The instruction
Insufficient access controls in Regular Labs Extension Manager for Joomla (versions 1.0.0–9.2.5) allow an unauthenticated attacker via CSRF or a low-privilege backend user to install, update, or remove extensions. Successful exploitation can lead to complete site compromise through the installation of a malicious extension. EPSS probability is low (0.13%) and no active exploitation or public exploit code has been identified.
Missing CSRF tokens, item-permission, and input-validation checks in Regular Labs Joomla extensions (Content Templater, ReReplacer, Snippets) allow unauthorized backend users or CSRF attacks to expose, create, or modify extension configuration and items. This high-severity flaw (CVSS 8.8) affects multiple versions, with low exploitation probability (EPSS 0.13%). No active exploitation or public exploit code has been identified.
Out-of-bounds read and write in the FFmpeg ADX audio decoder (libavcodec/adxdec.c) affects versions 4.4 through 8.1.2, where a mid-stream channel layout change corrupts memory. When AV_PKT_DATA_NEW_EXTRADATA side data arrives mid-stream, adx_decode_frame re-parses the header but leaves the internal channel state stale, so later decode operations index the prev[] state array with a wrong channel count. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw enables both reads and writes and carries a CVSS 4.0 base score of 8.7.
Memory corruption in FFmpeg 4.4 through 8.1.2 lets an attacker trigger a double-free in the NVIDIA NVDEC hardware decoder (libavcodec/nvdec.c) by getting a victim to process a crafted video file, potentially leading to code execution or crash in any NVDEC-accelerated pipeline. The flaw sits in the ff_nvdec_start_frame_sep_ref error path, which frees frame description data via nvdec_fdd_priv_free while the calling layer later frees the same object. No public exploit identified at time of analysis; a vendor upstream fix commit is available, and CVSS 4.0 is rated 8.7 (High).
MFA bypass in NetApp ONTAP 9.16.1 and later occurs when WebAuthn multi-factor authentication is configured, stemming from improper handling of the WebAuthn Relying Party ID. An attacker who already holds valid credentials can defeat the second authentication factor and gain full administrative access to the storage management plane. No public exploit identified at time of analysis; the flaw is vendor-reported by NetApp and not listed in CISA KEV.
Local privilege escalation in the servereye Windows agent (Sensorhub / ClientAgentContainerService) versions 20.15 and earlier lets any local standard user gain SYSTEM. The SYSTEM-level SE3Recovery service (EmergencyRecoveryService.exe) watches a world-writable directory for a trigger file and then runs UpdaterAction.exe, which performs an unvalidated file copy from a user-controlled source over a protected service binary, resulting in full system compromise. No public exploit identified at time of analysis; this was reported by NCSC.ch and is not listed in CISA KEV, so there is no evidence of active exploitation.
Denial of service in Netty's bzip2 compression codec allows remote unauthenticated attackers to permanently hang an event-loop thread by sending a malformed bzip2 stream, affecting applications that use the Bzip2Decoder in netty-codec (< 4.1.136.Final) or netty-codec-compression (>= 4.2.0.Final, < 4.2.16.Final). The flaw is an infinite loop (CWE-835) in the run-length-encoding state machine of Bzip2BlockDecompressor.read(), which never terminates on crafted input and starves the shared Netty I/O thread pool. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available.
Privilege escalation in the Grav CMS Login plugin (grav-plugin-login) <= 3.8.11 lets a low-privilege authenticated user promote their own account to super-admin by injecting privilege fields into a profile self-update request. The flaw lives in processUserProfile() (the update_user task), which — unlike the registration handler — fails to strip 'groups' and 'access' from user-submitted form data before persisting it. There is no public exploit identified at time of analysis and it is not in CISA KEV, but exploitation is trivial once the exposing configuration is present, and gaining super-admin unlocks admin panel access, scheduler-driven RCE, and Twig evaluation.
Authorization bypass in MongoDB Server allows an authenticated low-privileged user to read and write documents that should be shielded by role-based, query-level access controls. Because the server insufficiently validates certain client-supplied command parameters, crafted find, update, delete, and aggregate commands can sidestep the access boundaries enforced for a user's role. The flaw only manifests in non-apiStrict deployments (the default), and per the vendor CVSS 4.0 vector it yields high confidentiality and integrity impact; no public exploit has been identified at time of analysis.
DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling a signed zone to inject validly-signed NSEC records whose 'Next Domain Name' field points outside the signer's own zone, letting forged proofs of non-existence be applied to names the zone was never authorized to speak for. Because BIND fails to enforce that the NSEC chain stays within the signer's authority, an attacker can assert that arbitrary names in other zones do not exist, poisoning resolver behavior across zone boundaries (CVSS 8.6, Scope:Changed, integrity impact). There is no public exploit identified at time of analysis and the issue is not in CISA KEV.
Authentication bypass in Next.js App Router built with Turbopack when using a single i18n locale allows unauthenticated attackers to circumvent middleware or proxy‑based authentication via crafted requests. The vulnerability affects Next.js versions 16.0.0 through 16.2.10, and is exploitable without any user interaction. A patch is available in version 16.2.11.
Server-Side Request Forgery (SSRF) and open redirect in Next.js rewrite/redirect rules when the destination hostname is dynamically constructed from user-controlled input. Versions 12.0.0 to 15.5.20 and 16.0.0 to 16.2.10 are affected, allowing a remote attacker to proxy requests to arbitrary hosts or redirect users. Patched versions 15.5.21 and 16.2.11 are available; no active exploitation has been reported.
Local privilege escalation in Fujitsu openFT (managed file transfer) on GNU/Linux and Oracle Solaris allows an already-authenticated local user to gain root privileges on versions before 12.1D00. The flaw stems from improper privilege management (CWE-269) and carries a CVSS 4.0 base score of 8.5 (High). No public exploit identified at time of analysis; the intelligence was obtained internally by the Fsas Technologies PSIRT rather than from public disclosure.
Stored DOM cross-site scripting in n8n's Resource Locator component allows a low-privileged workflow author to execute arbitrary JavaScript in another user's browser session. The flaw stems from the workflow-persisted cachedResultUrl value being passed to window.open() without scheme validation, letting a javascript: URI fire when a victim opens the crafted workflow and clicks an external link. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but exploitation is realistic in shared/multi-tenant n8n instances.
OS command injection in MongoDB Compass allows an attacker to smuggle a malicious 'browser open command' for the OIDC authentication flow into an importable connection file, a setting normally restricted to global Compass application settings and not editable through the connection form. When a victim imports the crafted connection and initiates OIDC authentication, the attacker-controlled command executes on the victim's host with the user's privileges. No public exploit identified at time of analysis, but the CVSS 4.0 base score is 8.4 (High) reflecting full compromise of confidentiality, integrity, and availability of the local system.
Local privilege escalation in the Veeam Updater component of the Veeam Software Appliance allows a high-privileged local user to reach root-level control of the underlying operating system via path traversal (CWE-22). The flaw affects Veeam Backup & Replication deployed as the hardened software appliance, carries a CVSS 4.0 base score of 8.4, and was reported through HackerOne. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so current risk is latent rather than actively exploited.
Server-Side Request Forgery in the Vercel Next.js framework (versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10) lets a remote attacker who controls Host-associated headers coerce a Server Action's forwarded or redirected request to an attacker-chosen host, and in some setups leak internal values that weaken middleware/proxy authorization. Exploitation is limited to deployments where the incoming Host header is not pinned to a trusted value - typically custom servers or setups not fronted by a host-pinning proxy. There is no public exploit identified at time of analysis, EPSS is low (0.62%, 46th percentile), and CISA SSVC rates exploitation as 'none' with partial technical impact.
DOM-based cross-site scripting in n8n's HTML preview lets an authenticated global:member user execute JavaScript in the editor's same origin when a victim opens the preview. Because execution output is rendered into an iframe srcdoc without the sandbox attribute and a sanitizer bypass defeats the filtering, injected script runs same-origin and can invoke authenticated APIs using the victim's session, enabling account and workflow takeover. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
Denial of service in Next.js App Router with Server Actions allows remote attackers to exhaust CPU resources and block request processing. Affected versions include all 13.0.0–15.5.20 and 16.0.0–16.2.10 releases. No active exploitation or public exploit code has been identified at time of analysis.
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistence storage provider derives its storage key from user-controlled input, letting a remote attacker steer a path traversal into attacker-controlled deserialization. Because the CVSS vector is PR:N/UI:N, an unauthenticated remote attacker can chain the traversal to load a crafted serialized payload and execute arbitrary code, though the AC:H rating signals the attack is non-trivial to reliably trigger. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resolution in the persistence framework, where attacker-influenced persisted state is deserialized into arbitrary object types. Network-reachable attackers can leverage this to run arbitrary code on the hosting web server, though the CVSS High attack complexity (AC:H) indicates exploitation depends on influencing persisted state rather than a trivial single request. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the deserialization class and product history warrant urgent patching.
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state via cookie-based storage in RadPersistenceManager or RadDockLayout, causing the components to deserialize attacker-supplied cookie payloads. An unauthenticated remote attacker who can reach the application and craft a malicious serialized cookie can achieve code execution on the server. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; EPSS data was not provided.
Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 allows attackers to forge upload metadata so that the AsyncUploadTypeName value drives unsafe, attacker-controlled type resolution, letting them instantiate arbitrary types and run code on the hosting server. The flaw sits in the RadAsyncUpload (RAU) handler, historically an unauthenticated endpoint (CVSS PR:N), and carries an 8.1 High score tempered by AC:H, reflecting the crafting/forgery effort required. At time of analysis there is no public exploit identified and it is not in CISA KEV, though the same component has a long history of weaponized deserialization bugs.
Arbitrary file deletion in the WP Foodbakery WordPress plugin (all versions through 4.9) lets authenticated users with only subscriber-level access delete any file the web server can reach, because the 'delete_locations_backup_file_callback' handler fails to validate the supplied path. Deleting a critical file such as wp-config.php can cascade into remote code execution, which is why Wordfence tags this as an RCE-class issue. No public exploit has been identified at the time of analysis, but the high CVSS (8.1) and trivially low privilege bar make it a strong patching priority.
Provider type tampering in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 lets remote attackers manipulate the DialogHandler's provider type input to alter dialog processing, serving as a stepping stone for chained exploitation. The flaw stems from unsafe reflection (CWE-470), where externally-controlled input selects the class/code path handling dialog operations, and carries a CVSS 8.1 (high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Telerik components have a notable history of being targeted once weaponized.
Authentication bypass in Magarsus Consulting IDM-MFA (versions 2025.11.27 up to but not including 2026.03.10) lets remote unauthenticated attackers circumvent multi-factor authentication by supplying improperly-typed input that the application fails to validate. Because IDM-MFA is itself an identity and MFA gateway, a successful bypass undermines the primary control protecting downstream systems, yielding high confidentiality and integrity impact. Exploitation requires some victim interaction (CVSS UI:R), and there is no public exploit identified at time of analysis.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible for a low-privileged attacker positioned on the same physical communication segment as the host. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 8.0 and a scope change, meaning successful exploitation can significantly impact additional products beyond OPSS itself. Exploitation is rated difficult (AC:H) and there is no public exploit identified at time of analysis, so risk is elevated by potential blast radius rather than by ease of attack.
We need to produce a JSON object with all fields as plain-text strings. Input: CVE-2026-63265. Description: Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization. CVSS score 8.0, vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, CWE-352. EPSS 0.13% (percentile 3%). Reported by: Joomla (probably the vendor). CPE list: many extensions for Joomla. Tags list includes many extension names. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD affected versions list for many extensions. References: regularlabs.com and vuldb.com. We must synthesize into a comprehensive analysis. Fields: - product_name: "1-3 words ONLY. The specific product or service name affected." Since it's multiple extensions, but the core issue is Regular Labs extensions for Joomla. I'll pick "Regular Labs Joomla Extensions" (1-3 words, "Regular Labs Joomla Extensions" is 3 words, fine. Could also say "Regular Labs for Joomla" but better to be specific. Description mentions "Privileged Regular Labs AJAX endpoints" so it's across many Regular Labs extensions. So product_name: "Regular Labs Joomla Extensions". This covers the vendor and platform. - summary: 2-3 sentence plain-language. Don't copy description. Original synthesis. Mention what vulnerability, affected product, what attacker can do, if actively exploited, POC, EPSS risk. This is a CSRF vulnerability allowing authenticated lower-privileged users or CSRF attacks to perform unauthorized actions. Starts with impact: "Cross-site request forgery (CSRF) in Regular Labs Joomla extensions allows authenticated lower-privileged users or CSRF attacks to invoke unauthorized AJAX lookups and mutations." Then "Affected extensions (e.g., Advanced Module Manager, Articles Anywhere, etc.) fail to consistent
Authentication bypass in the Traefik reverse proxy (v2.11.51 and earlier, v3.6.0-v3.6.22, and v3.7.0-v3.7.6) allows unauthenticated remote attackers to reach protected backend routes by abusing the ReplacePathRegex middleware. When the middleware rewrites a path using a capture group lacking a mandatory separator, a crafted request such as GET /api../admin yields an un-normalized path (/../admin) that the middleware forwards without re-validation; a normalizing backend then resolves it to a protected route, skipping any auth middleware bound to that path. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied, but the flaw is trivially reproducible from the advisory's own example.
Command injection in the Ansible Lightspeed extension for Visual Studio Code lets a crafted project achieve arbitrary code execution on a developer's machine. The extension's ansible.python.activationScript setting is treated as a shell command rather than validated as a file path, so when a victim opens or runs a malicious repository, attacker-controlled content in that setting executes with the privileges of the VS Code process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure and potential data corruption in the Linux kernel's XFS filesystem can allow a local attacker with low privileges to achieve high integrity, confidentiality, and availability impact. The vulnerability resides in the reflink copy-on-write logic where stale data fork mappings are used after cycling the ILOCK, leading to inaccurate shared-extent tracking. No active exploitation or public exploit code has been identified at time of analysis, and a vendor patch is available.
Path traversal in IZArc v4.6's unrar.dll component enables arbitrary file writes outside the intended extraction directory when a victim extracts a maliciously crafted RAR archive. The vulnerability stems from insufficient path validation in the RAR extraction routine, permitting an attacker-controlled archive to place files at attacker-chosen filesystem paths with the victim user's privileges. No public exploit identified at time of analysis and EPSS sits at 0.21% (11th percentile), but SSVC rates technical impact as total, reflecting the high-C/I/A CVSS score if the attack chain completes.
Local privilege escalation in Analog Way Picturall Quad Compact Mark II firmware version 3.5.8 allows authenticated low-privileged users to gain root access via path traversal in a maintenance script. No active exploitation or public exploit code has been reported; vendor patch is available in version 3.5.9.
Local privilege escalation in Unistal Systems Protegent 360 v2.0.0.4 allows a low-privileged attacker to gain SYSTEM-level control through the sub_186f4 function. A publicly available proof-of-concept exists, but no active exploitation is currently reported and the EPSS estimate of 0.19% suggests low threat actor interest.
Local privilege escalation in Unistal Systems Protegent 360 v2.0.0.4 through its kernel driver pgsecdl.sys allows a low-privileged local attacker to gain complete system control. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed and the EPSS score is low (0.19%). The flaw stems from improper privilege management (CWE-269) in the driver.
Local privilege escalation in Duplicati v2.3.0.1 allows an authenticated standard user to replace DLLs in the service directory when the software is installed outside the default Program Files path. On service restart, the Windows service loads the attacker-controlled DLL, granting arbitrary code execution as SYSTEM. No active exploitation is reported, and EPSS probability is low at 0.18%.
Arbitrary code execution in the Visual Studio Code Ansible Lightspeed extension lets an attacker embed shell metacharacters in an Ansible playbook filename that the AnsiblePlaybookRunProvider passes unsanitized to a command invocation. When a developer opens the malicious project and runs the playbook, the injected characters execute arbitrary commands with the privileges of the VS Code user. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the local high-impact profile (CVSS 7.8, C:H/I:H/A:H) makes it a meaningful supply-chain/repository-poisoning risk for Ansible developers.
Local code execution in the Visual Studio Code Ansible (Lightspeed) extension lets a malicious project run arbitrary shell commands on a developer's machine by abusing the ansible.executionEnvironment.containerOptions and volumeMounts settings, which fail to sanitize shell separators (CWE-78). Because these are workspace-scoped settings, simply opening a booby-trapped repository can auto-trigger execution during Language Server initialization, yielding code execution as the VS Code user. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; CVSS is 7.8 (High).
Privilege escalation in n8n Enterprise SSO (versions before 1.123.64, 2.29.8, and 2.30.1) lets an SSO-authenticated user who controls their IdP-asserted instance-role claim be provisioned directly as global:owner, seizing full administrative control of workflows, credentials, users, and instance configuration. The instance-role provisioning path fails to block the owner role that the parallel token-exchange path explicitly rejects. Reported by VulnCheck with no public exploit identified at time of analysis; exploitation depends on a non-default configuration.
Denial of service (with potential memory corruption) in select Hikvision network cameras - specifically the DS-2CD and DS-2DE series - lets remote unauthenticated attackers crash or destabilize a device by sending specially crafted packets that trigger a heap buffer overflow. The flaw carries a CVSS 7.7 (AV:N/PR:N) and, per the supplied CVSS vector, high integrity and availability impact, though the vendor advisory characterizes the primary observable effect as device malfunction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-validating resolver with random-subdomain ('water torture') queries against a DNSSEC-signed zone. When queries arrive faster than the resolver can complete validation, memory consumption grows unbounded - orders of magnitude beyond the configured max-cache-size - eventually crashing the service. Affects a broad span of 9.11 through 9.21 release and supported-preview (-S) branches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC proof. When a provably-insecure delegation is covered by both NSEC and NSEC3 records at the parent but only one of those types carries an RRSIG, BIND hits a reachable assertion (CWE-617) and terminates while validating the insecurity proof. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, unauthenticated attack surface and named process termination make this a high-availability-impact issue for recursive resolvers.
Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthenticated attackers exhaust CPU by luring a validating resolver to query an authoritative zone that returns many valid-but-superfluous RRSIG records, which BIND always validates even when unnecessary. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects an availability-only impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and it is not in CISA KEV, but ISC has released fixed builds (9.20.26 and 9.21.24).
Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged records by returning an RRSIG with fewer labels than its containing zone, tricking `named` into synthesizing a wildcard name for a zone shorter than the attacker's own. Affected versions span the 9.11.x through 9.21.x branches (including -S subscription editions), and the flaw is exploitable against default deployments because the triggering feature `synth-from-dnssec` is enabled by default. No public exploit identified at time of analysis; the issue was reported by ISC and vendor patches (9.20.26, 9.21.24) are available.
RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Policy Zone protections or crash the daemon by sending queries with names long enough to trigger a NAMETOOLONG condition during RPZ processing. Affected are BIND 9.16.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23 and the corresponding -S (subscription) editions, but only where RPZ is configured with wildcard CNAME policies. No public exploit identified at time of analysis; the vendor (ISC) has released fixed builds 9.20.26 and 9.21.24.