CVE Notifier

CVE-2026-78227 CWE-416 6.5

Use-after-free in DoQ stream output buffer on reset re-transmission

NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response.…

cve.org NLnet · Labs:Unbound 16 Sep 2026

CVE-2026-77955 CWE-345 4.4

Possible ZONEMD verification bypass window

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with)…

cve.org NLnet · Labs:Unbound 16 Sep 2026

CVE-2026-77860 CWE-675 3.7

'serve-expired' can bypass Unbound 'wait-limit'

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter mea…

cve.org NLnet · Labs:Unbound 16 Sep 2026

CVE-2026-86338 CWE-1220 N/A

Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter…

cve.org ash-project:ash · ash-project:ash 16 Sep 2026

CVE-2026-88255 CWE-1289 N/A

mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot

Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre…

cve.org ZenHive:mpp · ZenHive:mpp 16 Sep 2026

CVE-2026-89774 CWE-? 8.8

Bluetooth: SCO: hold sk properly in sco_conn_ready

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid co…

cve.org Linux:Linux · Linux:Linux 16 Sep 2026

CVE-2026-89186 CWE-524 N/A

mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verify_credential in lib/mpp/plug.ex sets payment-receip…

cve.org ZenHive:mpp · ZenHive:mpp 16 Sep 2026

CVE-2026-73454 CWE-77 8.1

Security Advisory 0165

On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may res…

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-73439 CWE-842 7.5

Security Advisory 0164

On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to corre…

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-73461 CWE-266 8.0

Security Advisory 0163

On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AA…

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-89207 CWE-1287 6.5

CVE-2026-89207

A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices do not properly validate input received from backend service…

cve.org Siemens:WTV676-HB6035 · Web · Interface 16 Sep 2026

CVE-2026-86341 CWE-1280 4.4

Access Control Check Implemented After Asset is Accessed in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permis…

cve.org GitLab:GitLab 16 Sep 2026