EUVD-2026-80459

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00dodportdiagnostics allocates the qladportdiag response buffer with kmallocobj non-zeroing and, on success, copies the full sizeofdd back to user space via...

CVE-2026-89858 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00updatefruversions qla2x00updatefruversions copies the user-supplied BSG request into a fixed 256-byte stack buffer bsgDMAPOOLSIZE and then iterates list-count times over the...

CVE-2026-89843 scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t bsgDMAPOOLSIZE and fill it via sgcopytobuffer, which only copies as...

CVE-2026-86466

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...

CVE-2026-19640

On affected platforms running Arista EOS, an authenticated user with access to the gNMI gRPC Network Management Interface may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the...

CVE-2026-14917

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validateassertionsignature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without...

CVE-2026-14917

CVE-2026-14917 is a SAML authentication bypass in the Kong API Gateway Enterprise SAML plugin. When the validate_assertion_signature option is explicitly set to false (it is enabled by default ), the plugin extracts the SAML identity from an unsigned assertion without verifying a valid cryptograp...

CVE-2026-14917 Kong API Gateway Enterprise: SAML Authentication bypass

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validateassertionsignature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without...

EUVD-2026-80387

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validateassertionsignature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without...

CVE-2026-14917 Kong API Gateway Enterprise: SAML Authentication bypass

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validateassertionsignature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without...

CVE-2026-86466 Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...

CVE-2026-19640 Security Advisory 0170

On affected platforms running Arista EOS, an authenticated user with access to the gNMI gRPC Network Management Interface may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the...

CVE-2026-82310

The apache-airflow-providers-fab package is vulnerable to insufficient session expiration when used with Airflow 3 and the FAB auth manager with Core API token authentication. The root cause is that while password authentication correctly rejects disabled accounts, the Core API continues to accep...

EUVD-2026-80318

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

EUVD-2026-80301

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb-dev on deaggregated frames rmnetmapdeaggregate allocates each sub-frame with allocskb and leaves skb-dev NULL. rmnetmapingresshandler assigns skb-dev = ep-egressdev only on the data path, but a M...

CVE-2026-27555

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27548

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27553

A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...

CVE-2026-27551

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...

CVE-2026-73439 Security Advisory 0164

On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule fo...