CVE Vulnerability Catalog

In Unbound 1.10.0 through 1.25.1, with 'serve-expired: yes' and a 'response-ip' or 'rpz-cname-override' rule, a remote client controlling a delegated domain can crash the daemon. This is due to an inconsistency in the CNAME alias handling logic in serve-expired-client-timeout.

In Unbound 1.25.0 through 1.25.1, a fix enabling 'respip' and 'dns64' modules to work together creates a shallow copy of the view name, which can lead to memory corruption when the original view name owner is evicted under load. Crash likelihood is low.

In NLnet Labs Unbound up to 1.25.1, with 'unwanted-reply-threshold' enabled, glue records 0.0.0.0/::0 can cause a loop leading to cache clearing. An attacker controlling a delegation can repeatedly trigger cache flushes without spoofed packets.

NLnet Labs Unbound versions 1.7.0 to 1.25.1 have a vulnerability where an auth/rpz zone with a configured primary hostname that resolves to BOGUS A/AAAA is still considered a possible XFR endpoint. An attacker who can spoof the A/AAAA record (no valid RRSIG required) becomes the XFR primary and can replace the entire zone or resolver's response policy.

In Unbound 1.15.0 through 1.25.1, the TLS server name used for DoT queries is tied to a 'serviced_query' struct but also referenced by 'waiting_tcp'. When the struct is evicted during TLS handshake and an error occurs, a freed pointer is dereferenced, causing a daemon crash.

NLnet Labs Unbound versions 1.22.0 through 1.25.1 have a vulnerability where a single client query for a deeply nested name under a DNSSEC-signed parent can cause more upstream packets than the configured 'max-global-quota'. This bypasses a security configuration that limits amplification traffic.

In NLnet Labs Unbound up to 1.25.1, applications using libunbound with 'unwanted-reply-threshold' enabled may be abruptly terminated when the threshold is reached because 'libworker_alloc_cleanup' is not in the allowed call list. Unbound itself is not affected.

A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation.

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory.

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.

NLnet Labs Unbound versions 1.22.0 through 1.25.1 in DNS-over-QUIC environments with high concurrency can crash due to an assertion in libngtcp2 about monotonic timestamps. Unbound used realtime instead of monotonic time, causing server termination under load.

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of Windows authentication credentials.

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation.

Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provides the proper string it can result in a DoS attack. This issue was fixed in version 0.6.4.

Traefik versions up to 2.11.51, from 3.6.0 to 3.6.22, and from 3.7.0 to 3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. An unauthenticated attacker can send a crafted request that, after processing by the middleware, reaches the backend without path normalization validation, allowing access to protected resources.

n8n versions before 1.123.64, 2.29.8, and 2.30.1 have a credential exposure vulnerability. When configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field. Since JWT headers are Base64-encoded, the private key could be recovered by anyone logging or inspecting the JWT.

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.

n8n before versions 2.29.8 and 2.30.1 (since 2.27.0) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. A member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token. The workflow runs in the owner's context with the owner's credentials.

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP requests to arbitrary internal targets when SSRF protection is disabled.

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.