CVE-2026-102167

On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network...

CVE-2026-102167 Security Advisory 0197

On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network...

CVE-2026-102167 Security Advisory 0197

On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network...

EUVD-2026-93967

On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network...

CVE-2026-102167

A memory corruption vulnerability exists in the wired uplink network endpoints of affected Arista Wi-Fi access points . This flaw, categorized as a stack-based buffer overflow (CWE-121), allows an unauthenticated attacker positioned on the same network segment as the wired uplink to crash the sen...

CVE-2026-83550

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

Summary Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses...

CVE-2026-94293

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

EUVD-2026-92985

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

CVE-2026-105758

A flaw was found in vllm. An unauthenticated remote attacker can cause a Denial of Service DoS by sending requests with excessively high video processing parameters to affected API endpoints. Because the backend does not enforce upper bounds on user-controlled video frame counts and rates, the...

Security Advisory 0197

Security Advisory 0197 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-102167 CVSSv3.1 Base Score: 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSSv4.0 Base Score: 9.0...

CVE-2026-94293: Missing Authentication for Critical Function

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

PT-2026-107152

Name of the Vulnerable Software and Affected Versions Arista Wi-Fi access points affected versions not specified Description A memory corruption issue exists in the wired uplink network endpoints of the access point. This flaw allows an unauthenticated attacker located on the same network segment...

PT-2026-106361

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

CVE-2026-83550: Active Debug Code

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

PT-2026-115981

Summary Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses...

CVE-2026-105762 Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

CVE-2026-105762 Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

CVE-2026-71299

A flaw was discovered in Maestro where its REST API write endpoints were registered without proper authentication middleware . This vulnerability allows a remote attacker to perform unauthorized write operations, specifically creating, modifying, or deleting consumers and resource bundles . Such ...

CVE-2026-104975

The open-source project management tool Plane contains a cross-tenant asset authorization bypass in the Spaces app . Specifically, the EntityAssetEndpoint and AssetRestoreEndpoint within plane/space/views/asset.py serve public-board operations under /api/public/ but fail to implement necessary me...