CVE-2026-19655

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol DHCP relay/snooping configured with the information option Option 82, or with the DHCP server configured with match criteria based on the information option, an unauthenticated attacker connected to a client-facing...

CVE-2026-19655

CVE-2026-19655 affects Arista EOS when DHCP relay/snooping is configured with Option 82 (information option) or when the DHCP server uses match criteria based on that option. An unauthenticated attacker on a client-facing VLAN can send a specially crafted packet that triggers a DHCP Relay service...

CVE-2026-19655 On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthent

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol DHCP relay/snooping configured with the information option Option 82, or with the DHCP server configured with match criteria based on the information option, an unauthenticated attacker connected to a client-facing...

EUVD-2026-80003

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol DHCP relay/snooping configured with the information option Option 82, or with the DHCP server configured with match criteria based on the information option, an unauthenticated attacker connected to a client-facing...

CLSA-2026-1789414950 TuxCare security update for 82 packages (3 CVEs)

TuxCare rebuilt 82 packages to address 3 CVEs. Fixed in 3.4.13-tuxcare.3...

Security Advisory 0155

Security Advisory 0155 PDF Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-19655 CVSSv3.1 Base Score: 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSSv4.0 Base Score: 7.1...

Kibana 9.4.5 Security Update (ESA-2026-82)

Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not...

CVE-2026-24762

RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material access key, secret key, session token to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be...

CVE-2026-24762

RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material access key, secret key, session token to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be...

CVE-2026-24762

RustFS exposes credentials in plaintext in logs across versions alpha.13–alpha.81 due to logging sensitive credential material (access key, secret key, session token) at INFO level. This information disclosure could allow internal or external log consumers to obtain credentials and compromise Rus...

CVE-2026-24762 RustFS Logs Sensitive Credentials in Plaintext

RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material access key, secret key, session token to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be...

PT-2026-6208

Name of the Vulnerable Software and Affected Versions RustFS versions alpha.13 through alpha.81 Description RustFS logs sensitive credential material, including access key, secret key, and session token, to application logs at the INFO level. This results in credentials being recorded in plaintex...

Malicious code in billa-82 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa2448a408e1ed549ad371946707a41f41a692b0038032f2bf43dd2b1a619c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cinta-82 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46f9ce953d4ff4fd7c969f8668ef56b1d82511de08bfcd0f487b32fc62d3bdc1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in alvira-82 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4827d57ebb8edcc2c9b9f56f4fca6ed1d304b655e99e9c4bc8134a03a49cd249 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152444 Malicious code in alvino-82 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb78191f516da449e4380f1eaff06929a5581e04a5bd08faf0f7f0decb914cfd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-154116 Malicious code in cinta-82 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46f9ce953d4ff4fd7c969f8668ef56b1d82511de08bfcd0f487b32fc62d3bdc1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rita-82 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f70b75453db92294197f17654561086eabab38cbe28f4c12af5a0faec22a1cae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in alvino-82 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb78191f516da449e4380f1eaff06929a5581e04a5bd08faf0f7f0decb914cfd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bitha-82 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 154274a91b069be4b696df8d1432cb83ae13d8208ab3ca28641f51f3d10fa604 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...