CVE-2026-33609

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-90

Affected software

No affected versions have been published.

Timeline

Published
Apr 22, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-33616.4The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl_address' post meta value in versions upCVE-2026-336107.5A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a CVE-2026-336114.9An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cCVE-2026-336127.5A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.CVE-2026-336138.8Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the geneCVE-2026-336147.5An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutraCVE-2026-336159.1An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutraCVE-2026-336167.5An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper CVE-2026-336175.3An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidCVE-2026-336188.8Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP'sCVE-2026-336195.5PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 contains a server-side requeCVE-2026-33624.4The Short Comment Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Minimum Count' settings field in all ver