CVE Notifier

CVE-2026-86106 CWE-306 9.6

Security Advisory 0179

An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.

cve.org Arista · Networks:VeloCloud · Edge 16 Sep 2026

CVE-2026-14916 CWE-241 N/A

Kong API Gateway Enterprise: JWT Algorithm-Confusion

A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that …

cve.org Kong:Kong · Enteprise · Gateway 16 Sep 2026

CVE-2026-77190 CWE-20 6.5

Security Advisory 0177

On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause…

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-14917 CWE-288 N/A

Kong API Gateway Enterprise: SAML Authentication bypass

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract th…

cve.org Kong:Kong · Enterprise · Gateway 16 Sep 2026

CVE-2026-86474 CWE-295 N/A

Improper Certificate Validation in the Firmware Download vulnerability

The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker to perform man-in-the-middle attacks on the update channel.

cve.org Fermax · Electronica · S.A.U.:DUOX 16 Sep 2026

CVE-2026-76151 CWE-125 N/A

Out-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework (QtNetwork module)

Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of s…

cve.org qt:qt 16 Sep 2026

CVE-2026-73468 CWE-670 6.5

Security Advisory 0175

A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period.

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-73469 CWE-863 5.8

Security Advisory 0176

When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be…

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-73440 CWE-212 4.2

Security Advisory 0178

On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's runn…

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-89793 CWE-? 7.8

ublk: clear VM_MAYWRITE on read-only ublk char device mmap

In the Linux kernel, the following vulnerability has been resolved: ublk: clear VM_MAYWRITE on read-only ublk char device mmap ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never clears VM_MAYWRITE on the…

cve.org Linux:Linux · Linux:Linux 16 Sep 2026

CVE-2026-73453 CWE-94 10.0

Security Advisory 0174

An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Ru…

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-73455 CWE-130 7.5

Security Advisory 0173

On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.

cve.org Arista · Networks:EOS 16 Sep 2026