CVE-2026-77505

HighCVSS 8.1/10Last modified Sep 28, 2026

Description

Use after free in DNS Server allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Sep 8, 2026
Last modified
Sep 28, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-775064.8Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.CVE-2026-775075.3Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-CVE-2026-775083.5Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCHCVE-2026-775165.4MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tooCVE-2026-775175.4MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize CVE-2026-775185.0MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP CVE-2026-775195.4MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicatioCVE-2026-775205.4MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user'CVE-2026-7752110.0MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-applicatioCVE-2026-775224.3MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronizatioCVE-2026-775237.4MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path wCVE-2026-775249.9KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create Trigg
CVE-2026-77505: High severity, CVSS 8.1 | Vulnix