CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 05:50 UTC)

What this means for you

This week: 5,436 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,436; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product isc:bind. Show all products

13 CVEs, showing 1 to 13

CVE	Severity	Title	Published
CVE-1999-0024	Medium 5.0	DNS cache poisoning via BIND, by predictable query IDs. Assigned by mitre	Sep 29, 1999
CVE-2006-0987	Medium 5.0	The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, whi… Assigned by mitre	Mar 3, 2006
CVE-2015-5477 Known exploited	High 7.5	named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries. Assigned by mitre	Jul 29, 2015
CVE-2026-1519	High 7.5	If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU.	Mar 25, 2026
CVE-2026-3104	High 7.5	A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain.	Mar 25, 2026
CVE-2026-3119	Medium 6.5	Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record.	Mar 25, 2026
CVE-2026-3591	Medium 5.4	A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0).	Mar 25, 2026
CVE-2026-3039	High 7.5	BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets.	May 20, 2026
CVE-2026-3592	Medium 5.3	BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.	May 20, 2026
CVE-2026-3593	Critical 9.8	A use-after-free vulnerability exists within the DNS-over-HTTPS implementation.	May 20, 2026
CVE-2026-5946	High 7.5	Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes…	May 20, 2026
CVE-2026-5947	Medium 5.9	Undefined behavior may result due to a race condition leading to a use-after-free violation.	May 20, 2026
CVE-2026-5950	Medium 5.3	An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sendin…	May 20, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.