CVE-2026-114713 (v3: 8.6) 8 Nov 2026

The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allow... Read more ➔

CVE-2026-124422 (v3: 6.1) 8 Nov 2026

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holde... Read more ➔

CVE-2026-123616 (v3: 7.5) 8 Nov 2026

imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field.... Read more ➔

CVE-2026-123615 (v3: 7.5) 8 Nov 2026

imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header... Read more ➔

CVE-2026-123614 (v3: 9.8) 8 Nov 2026

imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a... Read more ➔

CVE-2026-123613 (v3: 5.3) 8 Nov 2026

Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the sam... Read more ➔

CVE-2026-123612 (v3: 2.3) 8 Nov 2026

rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the... Read more ➔

CVE-2026-123611 (v3: 3.7) 8 Nov 2026

rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group r... Read more ➔

CVE-2026-123610 (v3: 3.7) 8 Nov 2026

rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed outp... Read more ➔

CVE-2026-123609 (v3: 4) 8 Nov 2026

Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client s... Read more ➔

CVE-2026-123608 (v3: 7.5) 8 Nov 2026

Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CP... Read more ➔

CVE-2026-123607 (v3: 7.5) 8 Nov 2026

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3... Read more ➔

CVE-2026-123606 (v3: 7.5) 8 Nov 2026

The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bai... Read more ➔

CVE-2026-123605 (v3: 8.8) 8 Nov 2026

Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies a... Read more ➔

CVE-2026-123604 (v3: 7.5) 8 Nov 2026

Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC)... Read more ➔

CVE-2026-123603 (v3: 6.5) 8 Nov 2026

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26... Read more ➔

CVE-2026-123602 (v3: 5.9) 8 Nov 2026

The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to g... Read more ➔

CVE-2026-123601 (v3: 6.5) 8 Nov 2026

Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the wrap-around... Read more ➔

CVE-2026-123600 (v3: 4.8) 8 Nov 2026

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHand... Read more ➔

CVE-2026-123599 (v3: 3.7) 8 Nov 2026

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS cl... Read more ➔

CVE-2026-123598 (v3: 3.7) 8 Nov 2026

The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net... Read more ➔

CVE-2026-123597 (v3: 3.7) 8 Nov 2026

Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path t... Read more ➔

CVE-2026-123596 (v3: 8.8) 8 Nov 2026

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recurs... Read more ➔

CVE-2026-123595 (v3: 8.8) 8 Nov 2026

Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating r... Read more ➔

CVE-2026-123594 (v3: 4.8) 8 Nov 2026

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain an NSEC validation flaw that returns a secure pro... Read more ➔