Skip to content
Noroxi
By publication date

Exploited and new serious CVEs: November 2026

3,464 records · 10 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 16 of 35

  • CVE-2026-123959
    34Monitor

    TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow

    HighCVSS 8.5No exploitEPSS 0%

    totolink · ca300-poe4 days ago

  • CVE-2026-123960
    34Monitor

    TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow

    HighCVSS 8.6No exploitEPSS 0%

    totolink · ca300-poe4 days ago

  • CVE-2026-95870
    30Monitor

    wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter

    HighCVSS 7.5No exploitEPSS 0%

    tomdever · wpforo forum4 days ago

  • CVE-2026-123961
    34Monitor

    TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflow

    HighCVSS 8.6No exploitEPSS 0%

    totolink · ca300-poe4 days ago

  • RUSTSEC-2026-0503
    34Monitor

    eazip: symlink-target validation checks the wrong argument, allowing extraction path escapes on Windows

    HighCVSS 8.6No exploit

    4 days ago

  • CVE-2026-104014
    39Monitor

    Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization

    CriticalCVSS 9.8No exploitEPSS 0%

    naimurrahmannahid · naimur email otp verification for woocommerce4 days ago

  • CVE-2026-104746
    32Monitor

    Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta

    HighCVSS 8.1No exploitEPSS 0%

    stylemix · motors – car dealership & classified listings plugin4 days ago

  • CVE-2026-104768
    30Monitor

    AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option

    HighCVSS 7.5No exploitEPSS 0%

    rubengc · automatorwp – no-code workflow automation, integration & webhooks plugin, now with ai4 days ago

  • CVE-2026-109214
    28Monitor

    User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input

    HighCVSS 7.2No exploitEPSS 0%

    wedevs · user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submission4 days ago

  • CVE-2026-109230
    28Monitor

    WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameter

    HighCVSS 7.2No exploitEPSS 0%

    osamaesh · wp visitor statistics (real time traffic)4 days ago

  • CVE-2026-109991
    30Monitor

    FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay

    HighCVSS 7.5No exploitEPSS 0%

    teamfunnelkit · funnelkit payment gateway for stripe woocommerce4 days ago

  • CVE-2026-111317
    28Monitor

    JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source

    HighCVSS 7.2No exploitEPSS 0%

    jetmonsters · jetformbuilder — dynamic blocks form builder4 days ago

  • CVE-2026-111370
    28Monitor

    WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker Parameters

    HighCVSS 7.2No exploitEPSS 0%

    osamaesh · wp visitor statistics (real time traffic)4 days ago

  • CVE-2026-115548
    28Monitor

    Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

    HighCVSS 7.2No exploitEPSS 0%

    quttera · quttera threatsign – web malware scanner for wordpress4 days ago

  • CVE-2026-116537
    28Monitor

    Link Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameter

    HighCVSS 7.2No exploitEPSS 0%

    jackdewey · link library4 days ago

  • CVE-2026-116751
    30Monitor

    Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array Keys

    HighCVSS 7.5No exploitEPSS 0%

    amelia · booking for appointments and events calendar – amelia pro4 days ago

  • CVE-2026-118066
    37Monitor

    Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter

    CriticalCVSS 9.1Proof of conceptEPSS 2%

    latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpress4 days ago

  • CVE-2026-118267
    32Monitor

    WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert

    HighCVSS 8.1Proof of conceptEPSS 1%

    peterschulznl · wp data access – app builder for tables, forms, dashboards, charts & maps4 days ago

  • CVE-2026-119075
    39Monitor

    Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout

    CriticalCVSS 9.8No exploitEPSS 0%

    themegrill · registration form for woocommerce4 days ago

  • CVE-2026-119183
    28Monitor

    JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta

    HighCVSS 7.2No exploitEPSS 0%

    jetmonsters · jetformbuilder — dynamic blocks form builder4 days ago

  • CVE-2026-121265
    39Monitor

    SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    4 days ago

  • CVE-2026-121765
    28Monitor

    WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    cozmoslabs · translatepress4 days ago

  • CVE-2026-122231
    28Monitor

    WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Value

    HighCVSS 7.2No exploitEPSS 0%

    westguard · ws form lite – drag & drop contact form builder4 days ago

  • CVE-2026-123418
    28Monitor

    Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter

    HighCVSS 7.2No exploitEPSS 0%

    andy_moyle · church admin4 days ago

  • CVE-2026-123776
    39Monitor

    RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process

    CriticalCVSS 9.8No exploitEPSS 0%

    4 days ago

  • CVE-2026-93429
    28Monitor

    VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter

    HighCVSS 7.2No exploitEPSS 0%

    e4jvikwp · vikbooking hotel booking engine & pms4 days ago

  • CVE-2026-93755
    28Monitor

    Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For Header

    HighCVSS 7.2No exploitEPSS 0%

    happyforms · happyforms pro4 days ago

  • CVE-2026-93766
    28Monitor

    Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' Parameter

    HighCVSS 7.2No exploitEPSS 0%

    happyforms · happyforms pro4 days ago

  • CVE-2026-119156
    28Monitor

    Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]

    HighCVSS 7.2No exploitEPSS 0%

    codename065 · download manager4 days ago

  • CVE-2026-120839
    35Monitor

    WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    magepeople inc. · wptravelly4 days ago

  • CVE-2026-120841
    35Monitor

    WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    magepeople inc. · wptravelly4 days ago

  • CVE-2026-122041
    36Monitor

    Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via

    CriticalCVSS 9.1No exploitEPSS 0%

    themehigh · checkout field editor for woocommerce (pro)4 days ago

  • CVE-2026-120984
    36Monitor

    Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import

    CriticalCVSS 9.1No exploitEPSS 0%

    red hat · red hat build of keycloak4 days ago

  • CVE-2026-123966
    37Monitor

    Tenda AC19 saveParentControlInfo heap-based overflow

    CriticalCVSS 9.3No exploitEPSS 1%

    tenda · ac194 days ago

  • CVE-2026-99273
    0Monitor

    ksmbd: reserve space for the UTF-16 terminator in stream info

    Proof of conceptEPSS 0%

    linux · linux4 days ago

  • CVE-2026-99277
    30Monitor

    ksmbd: hold a connection reference for each session channel

    HighCVSS 7.5No exploitEPSS 0%

    linux · linux4 days ago

  • CVE-2026-99281
    31Monitor

    tun: Require CAP_NET_ADMIN to attach to an ownerless device

    HighCVSS 7.8No exploitEPSS 0%

    linux · linux4 days ago

  • CVE-2026-124314
    28Monitor

    Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities

    HighCVSS 7.1No exploitEPSS 0%

    frappe · erpnext4 days ago

  • CVE-2026-124315
    28Monitor

    Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items

    HighCVSS 7.1No exploitEPSS 0%

    frappe · erpnext4 days ago

  • CVE-2026-124318
    34Monitor

    Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields

    HighCVSS 8.6No exploitEPSS 0%

    treeio · treeio4 days ago

  • CVE-2026-124057
    34Monitor

    TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow

    HighCVSS 8.5No exploitEPSS 0%

    totolink · ca300-poe4 days ago

  • CVE-2026-124058
    34Monitor

    TOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflow

    HighCVSS 8.5No exploitEPSS 0%

    totolink · ca300-poe4 days ago

  • CVE-2026-124059
    34Monitor

    TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow

    HighCVSS 8.5No exploitEPSS 0%

    totolink · ca300-poe4 days ago

  • CVE-2026-124060
    34Monitor

    TOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflow

    HighCVSS 8.5No exploitEPSS 0%

    totolink · ca300-poe4 days ago

  • CVE-2026-120531
    28Monitor

    Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter

    HighCVSS 7.2No exploitEPSS 0%

    wedevs · subscribe2 – form, email subscribers & newsletters4 days ago

  • CVE-2026-123497
    30Monitor

    Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery

    HighCVSS 7.6No exploitEPSS 0%

    go-vikunja · vikunja4 days ago

  • CVE-2026-123501
    28Monitor

    Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes

    HighCVSS 7.1No exploitEPSS 0%

    go-vikunja · vikunja4 days ago

  • CVE-2026-123512
    33Monitor

    Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs

    HighCVSS 8.4No exploitEPSS 0%

    go-vikunja · vikunja4 days ago

  • CVE-2026-123513
    30Monitor

    Vikunja before 2.7.1 Auth Token Leak via API URL Change

    HighCVSS 7.6No exploitEPSS 0%

    go-vikunja · vikunja4 days ago

  • CVE-2026-123516
    28Monitor

    Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import

    HighCVSS 7.1No exploitEPSS 0%

    go-vikunja · vikunja4 days ago

  • CVE-2026-123517
    28Monitor

    Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint

    HighCVSS 7.1No exploitEPSS 0%

    go-vikunja · vikunja4 days ago

  • CVE-2026-123519
    28Monitor

    Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports

    HighCVSS 7.1No exploitEPSS 0%

    go-vikunja · vikunja4 days ago

  • CVE-2026-123520
    28Monitor

    Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion

    HighCVSS 7.1No exploitEPSS 0%

    go-vikunja · vikunja4 days ago

  • CVE-2026-123522
    28Monitor

    Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook

    HighCVSS 7.1No exploitEPSS 0%

    go-vikunja · vikunja4 days ago

  • CVE-2026-123523
    28Monitor

    Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache

    HighCVSS 7.1No exploitEPSS 0%

    go-vikunja · vikunja4 days ago

  • CVE-2026-123525
    28Monitor

    Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations

    HighCVSS 7.1No exploitEPSS 0%

    go-vikunja · vikunja4 days ago

  • CVE-2026-123528
    30Monitor

    Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware

    HighCVSS 7.6No exploitEPSS 0%

    go-vikunja · vikunja4 days ago

  • CVE-2026-123531
    34Monitor

    Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter

    HighCVSS 8.7No exploitEPSS 0%

    go-vikunja · vikunja4 days ago

  • CVE-2026-123532
    28Monitor

    gix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC Probe

    HighCVSS 7.1No exploitEPSS 0%

    gitoxidelabs · gitoxide4 days ago

  • CVE-2026-123534
    33Monitor

    Tornado before 6.6 Path Traversal via static_url() Version Hashing

    HighCVSS 8.3No exploitEPSS 0%

    tornadoweb · tornado4 days ago

  • CVE-2026-123538
    30Monitor

    OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation

    HighCVSS 7.5No exploitEPSS 0%

    openidentityplatform · openam4 days ago

  • CVE-2026-123542
    30Monitor

    OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization Flow

    HighCVSS 7.6No exploitEPSS 0%

    openidentityplatform · openam4 days ago

  • CVE-2026-123543
    34Monitor

    OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation

    HighCVSS 8.7No exploitEPSS 0%

    openidentityplatform · openam4 days ago

  • CVE-2026-123545
    28Monitor

    OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow

    HighCVSS 7.1No exploitEPSS 0%

    openidentityplatform · openam4 days ago

  • CVE-2026-123549
    37Monitor

    OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass

    CriticalCVSS 9.3No exploitEPSS 0%

    openidentityplatform · openam4 days ago

  • CVE-2026-123550
    37Monitor

    OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions

    CriticalCVSS 9.3No exploitEPSS 0%

    openidentityplatform · openam4 days ago

  • CVE-2026-123551
    40Plan

    OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket

    CriticalCVSS 10.0No exploitEPSS 0%

    openidentityplatform · openam4 days ago

  • CVE-2026-123554
    34Monitor

    Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check

    HighCVSS 8.7No exploitEPSS 0%

    zcashfoundation · zebra4 days ago

  • CVE-2026-123555
    34Monitor

    Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures

    HighCVSS 8.7No exploitEPSS 0%

    zcashfoundation · zebra4 days ago

  • CVE-2026-123557
    32Monitor

    Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection

    HighCVSS 8.2No exploitEPSS 0%

    zcashfoundation · zebra4 days ago

  • CVE-2026-123558
    34Monitor

    Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind

    HighCVSS 8.7No exploitEPSS 0%

    zcashfoundation · zebra4 days ago

  • CVE-2026-123559
    34Monitor

    Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation

    HighCVSS 8.7No exploitEPSS 0%

    zcashfoundation · zebra4 days ago

  • CVE-2026-123560
    34Monitor

    Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body

    HighCVSS 8.7No exploitEPSS 0%

    zcashfoundation · zebra4 days ago

  • CVE-2026-123562
    34Monitor

    Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection

    HighCVSS 8.7No exploitEPSS 0%

    sveltejs · devalue4 days ago

  • CVE-2026-123563
    34Monitor

    Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse

    HighCVSS 8.7No exploitEPSS 0%

    sveltejs · devalue4 days ago

  • CVE-2026-123564
    34Monitor

    Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays

    HighCVSS 8.7No exploitEPSS 0%

    sveltejs · devalue4 days ago

  • CVE-2026-123565
    34Monitor

    Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval

    HighCVSS 8.7No exploitEPSS 0%

    sveltejs · devalue4 days ago

  • CVE-2026-123566
    34Monitor

    Devalue before 5.9.3 CPU Amplification Denial of Service via uneval

    HighCVSS 8.7No exploitEPSS 0%

    sveltejs · devalue4 days ago

  • CVE-2026-123569
    34Monitor

    Devalue before 5.6.3 Denial of Service via Sparse Array Serialization

    HighCVSS 8.7No exploitEPSS 0%

    sveltejs · devalue4 days ago

  • CVE-2026-123570
    34Monitor

    Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123571
    34Monitor

    Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123572
    34Monitor

    Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123573
    34Monitor

    hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123574
    34Monitor

    Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123575
    34Monitor

    Hickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodies

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123576
    34Monitor

    Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123577
    34Monitor

    Hickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of Service

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123580
    34Monitor

    Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123584
    32Monitor

    Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses

    HighCVSS 8.2No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123586
    34Monitor

    Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123587
    35Monitor

    Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC

    HighCVSS 8.9No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123588
    34Monitor

    Hickory DNS Recursive Resolver Denial of Service via Cached Empty Connection Pool

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123591
    32Monitor

    Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Missing RFC 6840 Checks

    HighCVSS 8.2No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123592
    32Monitor

    Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collision

    HighCVSS 8.2No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123595
    34Monitor

    Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123596
    34Monitor

    Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123601
    33Monitor

    Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery

    HighCVSS 8.3No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123602
    32Monitor

    Hickory DNS Recursor Ghost Domain Attack via Child-Side NS RRset Caching

    HighCVSS 8.2No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123604
    34Monitor

    Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loop

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago

  • CVE-2026-123605
    34Monitor

    Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name

    HighCVSS 8.7No exploitEPSS 0%

    hickory-dns · hickory-dns4 days ago