CVE-2026-123579
DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODAT
CVSS
3.7
Low
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 8, 2026 · Last modified: Nov 8, 2026 · CWE-358
Not enough EPSS history yet.
DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a zone with wildcard records, an attacker can combine an NSEC3 record matching the query name with a signed wildcard record into a bogus positive response that validation accepts.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1236004.8 MED—
———Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an NSEC3 record matching the hashed QNAME. On-path attackers or malicious authoritative servers can replay a validly signed non-apex NSEC3 with the zone's signed SOA to serve an authenticated (AD=1) denial of any apex RRtype for the negative-cache TTL.1hCVE-2026-1235426.8 MED—
———OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared device storage can redeem it for access and ID tokens to impersonate the user.1hCVE-2026-1081784.2 MED13.3%
——4IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, so a token may be accepted for a purpose it was not intended for.22hCVE-2026-963036.5 MED53.1%
——16Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over a network.16dCVE-2026-858056.5 MED48.6%
——15Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.22dCVE-2026-701748.8 HIG60.3%
——18Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.16d