Login Request a demo
UN
Product
Unbound
by Nlnetlabs · last CVE Sep 16, 2026
73
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities73In the news0Timeline
Severity mix
Critical 12High 23Medium 25Low 8
Severity
All severities73Critical12High23Medium25Low8
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Unbound to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-77860
3.7
0%
Sep 16
'serve-expired' can bypass Unbound 'wait-limit'
Affected: 1.20.0 before 1.26.1
CVE-2026-54478
3.7
0%
Jul 22
DNS Cookie bypass when combined with proxy-protocol use
Affected: 1.18.0 before 1.25.2
CVE-2026-50243
3.7
0%
Jul 22
'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL
Affected: 1.6.2 before 1.25.2
CVE-2026-46582
3.7
0%
Jul 22
A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path
Affected: 1.6.0 before 1.25.2
CVE-2026-44687
3.7
0%
Jul 22
Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN
Affected: 1.13.2 before 1.25.2
CVE-2026-42955
3.7
0%
Jul 22
Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records
Affected: 1.16.2 before 1.25.2
CVE-2026-41637
3.7
0%
Jul 22
Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries
Affected: 1.22.0 before 1.25.2
CVE-2026-55708
3.1
0%
Jul 22
Privacy/configuration issue when adding local data in views through 'unbound-control'
Affected: 1.6.0 before 1.25.2
Showing 8