CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 08:00 UTC)

What this means for you

This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,437; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product powerdns:dnsdist. Show all products

18 CVEs, showing 1 to 18

CVE	Severity	Title	Published
CVE-2026-33602	High 8.2	A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.	Apr 22, 2026
CVE-2026-33599	High 8.1	A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (Lua) option to newServer or auto_upgrade (YAML) settings.	Apr 22, 2026
CVE-2026-33598	Critical 9.1	A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a packet cache.	Apr 22, 2026
CVE-2026-33597	High 7.5	PRSD detection denial of service	Apr 22, 2026
CVE-2026-33596	Medium 6.5	A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed queries that are routed to a TCP-only or DN…	Apr 22, 2026
CVE-2026-33595	High 7.5	A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the conne…	Apr 22, 2026
CVE-2026-33594	High 7.5	A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing queries to accumulate into a buffer that will not be released unt…	Apr 22, 2026
CVE-2026-33593	High 7.5	A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.	Apr 22, 2026
CVE-2026-33254	High 7.5	An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a denial of service.	Apr 22, 2026
CVE-2026-33260	High 7.5	An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service.	Apr 22, 2026
CVE-2026-33257	High 7.5	An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service.	Apr 22, 2026
CVE-2026-27854	High 7.5	An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code.	Mar 31, 2026
CVE-2026-27853	High 7.5	An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName methods in custom Lua code.	Mar 31, 2026
CVE-2026-24030	High 7.5	An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service.	Mar 31, 2026
CVE-2026-24029	Medium 6.5	When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send D…	Mar 31, 2026
CVE-2026-24028	High 8.2	An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets.	Mar 31, 2026
CVE-2026-0397	Medium 4.3	When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information abo…	Mar 31, 2026
CVE-2026-0396	Medium 4.3	An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules have been enabled via either Dyn…	Mar 31, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.