CVE-2026-9085

HighCVSS 8.8

Published: 05/07/2026(UTC)Updated: 25/10/2026(UTC)Translated: 07/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

A vulnerability in Pardus-Parental-Control allows DNS spoofing due to incorrect permission assignment for critical resources and improper access control. The issue affects versions up to and including 0.5.1, before 0.7.0.

Risk Assessment

An attacker can redirect the victim's DNS traffic, leading to data interception, phishing, or other man-in-the-middle attacks.

Recommendation

Immediately update Pardus-Parental-Control to version 0.7.0 or later.

Other vulnerabilities in Pardus-Parental-Control

CVE-2026-102568Medium
Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including DNS filtering and application limits without authentication.

Original NVD description (English source)

Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing. This issue affects Pardus-Parental-Control: from <=0.5.1 before 0.7.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS