Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 03:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

151-75% vs 7-day avg of 598

2 critical, 41 high, 61 medium, 27 low

Expand	Severity	Score	Advisory	Title	Source	Flags	Published
	Medium	6.3	CVE-2026-116013	OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths... openrestyopenresty lua-resty-dns	NVD		Oct 24 12:16 UTC
CVE-2026-116013OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths... Executive summary The advisory describes an input validation flaw in the OpenResty lua-resty-dns library, which fails to check DNS resource record lengths in its parsing functions. The text provided does not state how severe the flaw is or what fixed version is recommended beyond saying the library is affected before 0.24. Defenders should check whether they use lua-resty-dns and plan to upgrade to a release that includes the fix. Technical summary The flaw is an improper input validation issue in parse_section() and _decode_name(), which fail to check resource record lengths when parsing DNS responses. The advisory states the affected versions as before 0.24, but the file excerpt shows _VERSION as 0.22 and the page header refers to v0.23, and no fixed version is explicitly stated beyond the 0.24 boundary. The attack vector, required preconditions, exploitation status, CVSS score, workarounds, and detection guidance are not stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openresty/lua-resty-dns/blob…solver.lua#L396-L442 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openresty openresty lua-resty-dns NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee