CVE-2026-101015

HighCVSS 7.3/10Last modified Oct 1, 2026

Description

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-20 CWE-1289

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 28, 2026
Last modified: Oct 1, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1010166.5A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_policy_parse_dmarc in th CVE-2026-1010176.5A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library CVE-2026-1010184.7A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function group_all_edit of the file dayrui/App/Member CVE-2026-1010196.5Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with lib CVE-2026-1010208.5An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerab CVE-2026-1010217.5MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boun CVE-2026-1010224.3A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts m CVE-2026-1010239.1Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the to CVE-2026-1010248.8Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authentica CVE-2026-1010255.3Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails CVE-2026-1010277.7When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address ag CVE-2026-1010286.0Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2,