Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
π GNA-1 (CIRCL)
Select from 85 available sources using the dropdown above.
| ID | Description | Published | Updated |
|---|---|---|---|
| msrc_cve-2026-97206 | DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments. | 2026-10-22T01:11:13.000Z | 2026-10-25T01:47:49.000Z |
| msrc_cve-2026-67409 | RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS | 2026-10-21T01:10:51.000Z | 2026-10-25T01:47:42.000Z |
| msrc_cve-2026-67404 | RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch | 2026-10-21T01:10:44.000Z | 2026-10-25T01:47:39.000Z |
| msrc_cve-2026-66076 | RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure | 2026-10-21T01:10:32.000Z | 2026-10-25T01:47:35.000Z |
| msrc_cve-2026-67418 | RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers | 2026-10-17T01:08:26.000Z | 2026-10-25T01:47:07.000Z |
| msrc_cve-2026-86562 | Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse) | 2026-10-17T01:04:10.000Z | 2026-10-25T01:47:03.000Z |
| msrc_cve-2026-100236 | Dpdk: dpdk: heap out-of-bounds read/write in gso header copy | 2026-10-17T01:04:04.000Z | 2026-10-25T01:46:59.000Z |
| msrc_cve-2026-86567 | Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap | 2026-10-17T01:03:58.000Z | 2026-10-25T01:46:56.000Z |
| msrc_cve-2026-86565 | Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write | 2026-10-17T01:03:50.000Z | 2026-10-25T01:46:53.000Z |
| msrc_cve-2026-108985 | ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored. | 2026-10-13T01:14:22.000Z | 2026-10-25T01:46:45.000Z |
| msrc_cve-2026-94286 | Out-of-bounds read in libXtst's RECORD reply parser | 2026-09-29T01:07:38.000Z | 2026-10-25T01:45:26.000Z |
| msrc_cve-2026-94282 | Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion | 2026-09-29T01:06:18.000Z | 2026-10-25T01:45:22.000Z |
| msrc_cve-2026-93541 | Out-of-bounds read in libXi's XQueryDeviceState() | 2026-09-28T03:25:30.000Z | 2026-10-25T01:45:19.000Z |
| msrc_cve-2026-93544 | Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing | 2026-09-28T03:23:56.000Z | 2026-10-25T01:45:16.000Z |
| msrc_cve-2026-93543 | Out-of-bounds read in libXi's XI2 class parser | 2026-09-28T03:22:17.000Z | 2026-10-25T01:45:13.000Z |
| msrc_cve-2026-93542 | Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() | 2026-09-28T03:20:59.000Z | 2026-10-25T01:45:10.000Z |
| msrc_cve-2026-94281 | Out-of-bounds read in libXi's XListInputDevices() class parsing | 2026-09-28T03:18:30.000Z | 2026-10-25T01:45:07.000Z |
| msrc_cve-2026-93545 | Out-of-bounds read in libXi's XListInputDevices() | 2026-09-28T03:15:21.000Z | 2026-10-25T01:45:03.000Z |
| msrc_cve-2026-19666 | Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path | 2026-09-21T01:02:55.000Z | 2026-10-25T01:44:59.000Z |
| msrc_cve-2026-19941 | checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof | 2026-09-21T01:02:42.000Z | 2026-10-25T01:44:53.000Z |
| msrc_cve-2026-19662 | qpcache NOQNAME proof use-after-free crashes recursive resolver | 2026-09-21T01:02:36.000Z | 2026-10-25T01:44:50.000Z |
| msrc_cve-2026-37236 | grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs. | 2026-09-02T01:04:47.000Z | 2026-10-25T01:44:44.000Z |
| msrc_cve-2026-76163 | named aborts on a TKEY query when the user configuration has no global options statement | 2026-09-21T01:02:24.000Z | 2026-10-25T01:44:43.000Z |
| msrc_cve-2026-81563 | SVCB AliasMode additional-data error leaks qpcache references | 2026-09-21T01:02:17.000Z | 2026-10-25T01:44:40.000Z |
| msrc_cve-2023-53543 | vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check | 2026-02-25T01:03:25.000Z | 2026-10-25T01:44:38.000Z |
| msrc_cve-2026-19668 | Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching | 2026-09-21T01:01:59.000Z | 2026-10-25T01:44:32.000Z |
| msrc_cve-2026-80274 | Validating resolver can abort while caching a mismatched NOQNAME proof | 2026-09-21T01:01:53.000Z | 2026-10-25T01:44:28.000Z |
| msrc_cve-2026-78301 | Out-of-zone database nodes can become authoritative zone cuts | 2026-09-21T01:01:46.000Z | 2026-10-25T01:44:25.000Z |
| msrc_cve-2026-19667 | Remote assertion failure via 16-bit length truncation in `dns_ncache_add()` | 2026-09-21T01:01:40.000Z | 2026-10-25T01:44:22.000Z |
| msrc_cve-2026-81870 | OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs | 2026-09-19T01:05:45.000Z | 2026-10-25T01:44:11.000Z |