NLnet Labs Unbound versions 1.6.0 through 1.25.1 have a vulnerability in the 'view_local_data' and 'view_local_datas' commands of 'unbound-control'. These commands create a local zones tree for a named view without including default-protected zones such as RFC 1918 reverse, AS112 zones, .onion, and .localhost. As a result, queries for these default-protected names bypass local policy and are sent to the public DNS instead of being answered locally.
NLnet Labs Unbound versions 1.10.0 through 1.25.1 contain a vulnerability triggered when 'serve-expired: yes' is configured alongside certain 'response-ip' redirect or RPZ CNAME override rules. This flaw allows a remote attacker controlling a delegated domain within the configured response-ip subnet to cause a NULL pointer dereference, crashing the Unbound daemon and resulting in a denial of service.
NLnet Labs Unbound versions 1.23.0 through 1.25.1, when configured with 'dns-error-reporting: yes', contain a vulnerability involving improper handling of the EDNS Report-Channel option. This flaw causes Unbound to read beyond the intended domain name length, leading to a stack variable overwrite and daemon termination. The vulnerability results in a denial of service condition.
NLnet Labs Unbound versions 1.7.0 through 1.25.1 with DNSCrypt support enabled contain a vulnerability where a misconfiguration in the 'dnscrypt:' clause causes Unbound to dereference garbage data. This occurs when more 'dnscrypt-provider-cert:' files are listed than matching 'dnscrypt-secret-key:' files, leading to a server crash upon receiving a specific UDP datagram. The issue results in a denial of service due to server termination triggered by unauthenticated client input.
NLnet Labs Unbound versions 1.22.0 through 1.25.1 contain a vulnerability where a remote unauthenticated client can cause the Unbound DNS resolver process to abort. This occurs when Unbound, compiled with assertions enabled, improperly handles an error value from the libngtcp2 library during DNS-over-QUIC (DoQ) connections, leading to an assertion failure and process termination.
NLnet Labs Unbound up to and including version 1.25.1 contains a heap buffer overflow vulnerability in the DNSSEC validator when processing certain RRSIG-covered PX, RP, MINFO, or SOA resource records. The issue arises because the validator does not verify the presence of a second embedded domain name before passing its address to a function that converts domain names to lowercase, potentially causing out-of-bounds memory reads and heap corruption. This vulnerability has a medium severity rating and a CVSS score of 4.8.
NLnet Labs Unbound versions 1.20.0 through 1.25.1 have a vulnerability when configured with 'serve-expired: yes' and 'serve-expired-client-timeout' greater than 'discard-timeout' greater than zero. This misconfiguration causes a counter related to reply addresses to not decrement properly, potentially leading to silent drops of new clients for duplicate in-flight queries and degradation of DNS resolution service. Default shipped values prevent this branch from being reached.
CVE-2026-60162 is a medium severity vulnerability in Oracle VM VirtualBox Core component affecting version 7.2.12 and multiple other specific versions. It requires high privileges and local access to exploit. The vulnerability can lead to unauthorized access to critical data and partial denial of service, impacting confidentiality and availability but not integrity. No known exploits in the wild have been reported. Oracle has issued a Critical Patch Update advisory recommending timely application of patches to address this and other vulnerabilities.
CVE-2026-60161 is a medium severity vulnerability in Oracle VM VirtualBox Core component affecting multiple specific versions including 5.0.4-dfsg-2 through 5.0.18-dfsg-2build1. It allows an unauthenticated local attacker, requiring user interaction, to cause denial of service or unauthorized modification of accessible data. The vulnerability impacts integrity and availability but does not have confirmed exploits in the wild. Oracle has issued a Critical Patch Update advisory recommending timely application of patches for affected products.
CVE-2026-60160 is a medium severity vulnerability affecting Oracle VM VirtualBox version 7.2.12 and multiple other specified versions. It allows a highly privileged local attacker to gain unauthorized read access to some data accessible by VirtualBox, impacting confidentiality without affecting integrity or availability. The vulnerability has a CVSS 3.1 base score of 3.2, indicating low to medium impact. No explicit patch or remediation status is provided in the available data. The vendor advisory references a broad Critical Patch Update but does not specifically confirm a fix for this vulnerability. The affected versions include multiple specific builds of Oracle VM VirtualBox 5.0.x series. There is no indication of known exploits in the wild or cloud service impact.
CVE-2026-60159 is a vulnerability in Oracle VM VirtualBox core component version 7.2.12 that allows a highly privileged local attacker to compromise the VirtualBox environment. The vulnerability has a CVSS 3.1 base score of 7.5, indicating significant impacts on confidentiality, integrity, and availability. Exploitation requires high privileges and local access, making it difficult to exploit. Multiple versions across the 5.x, 6.x, and 7.x series are affected. Oracle has released security patches as part of its July 2026 Critical Patch Update advisory.
CVE-2026-60158 is a medium severity vulnerability in Oracle VM VirtualBox Core component affecting version 7.2.12 and multiple other specific versions. It allows a low privileged attacker with logon access to compromise the product, potentially leading to unauthorized modification of critical data and partial denial of service. The vulnerability has a CVSS 3.1 base score of 6.4. Oracle has released security patches addressing this and many other vulnerabilities in their July 2026 Critical Patch Update advisory.
CVE-2026-60155 is a vulnerability in Oracle VM VirtualBox Core component affecting version 7.2.12. It requires high privileges and local access to exploit and can lead to complete takeover of the VirtualBox environment, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 7.5. No patch or remediation details are provided in the input data. The vulnerability may also affect other products due to the nature of the attack.
CVE-2026-60150 is a vulnerability in Oracle VM VirtualBox version 7.2.12 that allows a low privileged attacker with logon access to compromise the VirtualBox environment. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 base score of 7.8. Exploitation can lead to full takeover of the VirtualBox environment. The affected versions include multiple 5.0.x dfsg builds. There is no explicit vendor advisory patch link provided for this specific VirtualBox vulnerability, and the Oracle Critical Patch Update advisory does not mention VirtualBox patches. No known exploits are reported in the wild. The severity is assessed as medium based on the CVSS score and impact description.
CVE-2026-47062 is a medium severity vulnerability in Oracle VM VirtualBox version 7.2.12 that allows a low privileged attacker with logon access to cause a denial of service by hanging or crashing the software. This vulnerability affects availability but does not impact confidentiality or integrity.
CVE-2026-47055 is a medium severity vulnerability in Oracle VM VirtualBox version 7.2.12 that allows a highly privileged attacker with logon access to modify certain data within the product. The vulnerability impacts integrity but does not affect confidentiality or availability. No known exploits are reported in the wild. Oracle has issued a Critical Patch Update advisory covering multiple products, including Oracle VM VirtualBox, recommending timely patching to mitigate such vulnerabilities.
CVE-2026-47054 is a vulnerability in Oracle VM VirtualBox version 7.2.12 on Windows hosts that allows a low privileged local attacker to compromise the VirtualBox environment, potentially leading to full takeover. The CVSS 3.1 base score is 7.8, indicating a high impact on confidentiality, integrity, and availability. The vulnerability affects specific older versions of VirtualBox, primarily Debian/Ubuntu dfsg builds of version 5.0.x series. Oracle has released security patches as part of their Critical Patch Update in July 2026. No known exploits are reported in the wild. Users are strongly advised to apply the official patches promptly.
CVE-2026-47053 is a medium severity vulnerability in Oracle VM VirtualBox version 7.2.12 that allows a low privileged attacker with logon access to the host to compromise the VirtualBox environment. Exploitation requires user interaction from a third party. Successful exploitation can lead to unauthorized modification of critical or accessible data within VirtualBox and may cause a partial denial of service.
CVE-2026-47050 is a vulnerability in Oracle VM VirtualBox version 7.2.8 that allows a highly privileged local attacker, requiring user interaction, to compromise the product. Exploitation can lead to unauthorized modification or deletion of critical data and cause denial of service through crashes. The vulnerability affects multiple specific older versions of VirtualBox. The CVSS 3.1 base score is 7.4, indicating medium severity.
CVE-2026-47047 is a vulnerability in Oracle VM VirtualBox version 7.2.12 that allows a low privileged attacker with logon access to the host to potentially take full control of the virtualization environment. The vulnerability has a CVSS 3.1 base score of 7.8, indicating a high impact on confidentiality, integrity, and availability. The affected versions include multiple specific builds of version 5.0.x of VirtualBox. Oracle has released a Critical Patch Update in July 2026 addressing this and many other vulnerabilities. No known exploits in the wild have been reported. Users are strongly advised to apply the official patches promptly to mitigate the risk.