CVE Notifier

CVE-2026-73438 CWE-617 5.3

Security Advisory 0172

On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can c…

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-85628 CWE-319 N/A

Cleartext Transmission of Sensitive Information in the Pairing Process vulnerability

Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in versions prior to 4.3.4 of the application and 01.50.001 of th…

cve.org Fermax · Electronica · S.A.U.:DuoxMe 16 Sep 2026

CVE-2026-84501 CWE-117 N/A

Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name do…

cve.org Apache · Software · Foundation:Apache 16 Sep 2026

CVE-2026-84439 CWE-117 N/A

Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters (\t) e…

cve.org Apache · Software · Foundation:Apache 16 Sep 2026

CVE-2026-79993 CWE-862 N/A

Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the z…

cve.org Apache · Software · Foundation:Apache 16 Sep 2026

CVE-2026-59969 CWE-297 N/A

Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerifica…

cve.org Apache · Software · Foundation:Apache 16 Sep 2026

CVE-2026-59739 CWE-862 N/A

Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting af…

cve.org Apache · Software · Foundation:Apache 16 Sep 2026

CVE-2026-73436 CWE-1284 6.5

Security Advisory 0171

On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-73435 CWE-345 8.2

Security Advisory 0171

On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authenti…

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-86466 CWE-346 N/A

Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provi…

cve.org Apache · Software · Foundation:Apache 16 Sep 2026

CVE-2026-86443 CWE-312 N/A

Cleartext Storage of Sensitive Information Vulnerability

Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the device to retrieve the credentials stored by the application and i…

cve.org Fermax · Electronica · S.A.U.:DuoxMe 16 Sep 2026

CVE-2026-19640 CWE-863 4.2

Security Advisory 0170

On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently …

cve.org Arista · Networks:EOS 16 Sep 2026