CVE WatchJul 22, 2026

CVE-2026-55708

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a

CVSS

3.1

Low

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Jul 22, 2026 · Last modified: Jul 22, 2026 · CWE-1188

EPSS · 30d

Not enough EPSS history yet.

Technical description

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.

Official references

www.nlnetlabs.nlhttps://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55708.txt

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-473939.8 CRI

—

——0PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_api_server_code`) that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart (`praisonai deploy --type api`) get a server that binds to `0.0.0.0` per the recommended sample YAML, exposes `/chat` and `/agents` endpoints, runs `praisonai.run()` on user-supplied JSON input — LLM orchestration with the API key materials present in the process environment, and does not require any authentication. Versions prior to 4.6.40 still ship the generator with `auth_enabled` defaulting to `False`. The fix shape is opt-in via `APIConfig(auth_enabled=True, auth_token=...)`. Version 4.6.40 fixes the issue.8h CVE-2026-624159.1 CRI

—

——0The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.1d CVE-2026-600249.8 CRI

22.4%

——7The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets.2d CVE-2026-621857.6 HIG

20.5%

——6Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attackers can exploit this unrestricted network access through combined attacks to achieve cluster compromise and remote code execution.7d CVE-2026-614397.5 HIG

17.6%

——5PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt injection attacks such as instruction overrides or financial manipulation that trigger HIGH severity detection but are logged without blocking, enabling system prompt extraction and unauthorized tool invocations.8d CVE-2026-548004.8 MED

4.3%

——1A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application ships with a default configuration that disables all OPC UA security mechanisms. This could allow an attacker to gain unauthorized access and control over critical system functions.13d