CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,501 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,501
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product powerdns:recursor. Show all products

15 CVEs, showing 1 to 15
CVESeverityTitlePublished
CVE-2026-33601Medium 4.9If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a missing consistency check and leading to…Apr 22, 2026
CVE-2026-33600Medium 4.9An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.Apr 22, 2026
CVE-2026-33262Medium 5.9An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.Apr 22, 2026
CVE-2026-33261Medium 5.9A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.Apr 22, 2026
CVE-2026-33260High 7.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service.Apr 22, 2026
CVE-2026-33259Medium 5.0Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor.Apr 22, 2026
CVE-2026-33258High 7.5By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.Apr 22, 2026
CVE-2026-33257High 7.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service.Apr 22, 2026
CVE-2026-33256High 7.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service.Apr 22, 2026
CVE-2026-24027Medium 5.3Crafted zones can lead to increased incoming network traffic.Feb 9, 2026
CVE-2026-0398Medium 5.3Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.Feb 9, 2026
CVE-2025-59024Medium 6.5Crafted delegations or IP fragments can poison cached delegations in Recursor.Feb 9, 2026
CVE-2025-59023High 8.2Crafted delegations or IP fragments can poison cached delegations in Recursor.Feb 9, 2026
CVE-2025-59030High 7.5An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.Dec 9, 2025
CVE-2025-59029Medium 5.3An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with qtype set to ANY.Dec 9, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.