CVE-2026-84439

Apache ZooKeeper is affected by an audit log injection vulnerability in zookeeper_audit.log. When audit logging is enabled (zookeeper.audit.enable=true), two attack vectors exist: an unauthenticated attacker can embed tab characters (\t) in a digest authentication username, and an authenticated c...

CVE-2026-79993

Apache ZooKeeper versions 3.9.0–3.9.5 and 3.8.0–3.8.6 are affected by an authorization bypass in the deleteContainer opcode (0x14/20). This opcode is treated as internal-only, yet its request path skips both the session check and the DELETE ACL check enforced by the regular delete path. As a resu...

CVE-2026-59969

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum, zookeeper.fips-mode, ssl.quorum.hostnameVerification, and ssl.quorum.clientHostnameVerification are all enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate w...

CVE-2026-59739

Apache ZooKeeper has an information disclosure vulnerability in the DataTree.setWatches() reconnect replay handler (SetWatches/SetWatches2). This is an incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799): the prior patch added an ACL check in WatchManager.triggerWatch(), but DataTree.setWatches() ...

CVE-2026-73436

CVE-2026-73436 affects Arista EOS when OSPFv2 segment routing is configured. A specially crafted OSPFv2 packet from an adjacent neighbor can trigger an unexpected OSPF process restart , causing a high availability impact (CVSS 3.1: 6.5 Medium; CVSS 4.0: 6.0 Medium). The root cause is linked to CW...

CVE-2026-73435

CVE-2026-73435 affects Arista EOS routers running OSPFv2 with cryptographic authentication (MD5 or SHA) on a broadcast interface with at least two neighbors. An unauthenticated attacker on the same broadcast segment can send a specially crafted OSPFv2 packet to cause adjacency flapping and packet...

CVE-2026-86466

The Authentik OAuth path in the Apache Airflow FAB auth manager fails to validate the issuer and audience claims of the accepted id_token. An attacker holding a valid token minted by the same Authentik instance for a different client application can present it to Airflow and be authenticated as t...

CVE-2026-86443

DuoxMe for Android, in versions prior to 4.3.4 , stores sensitive credentials in cleartext , allowing an attacker with local access to the device to retrieve them and impersonate the user account . The CNA-assigned CVSS 4.0 score is 6.9 (MEDIUM) (AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/SC:H/VI:N/SI:H/VA:N/...

CVE-2026-19640

CVE-2026-19640 is an incorrect authorization flaw (CWE-863) in Arista EOS affecting the gNMI (gRPC Network Management Interface) . An authenticated user with gNMI access may receive incorrect authorization results, potentially gaining access beyond their assigned permissions. Arista discovered th...

CVE-2026-76187

CVE-2026-76187 affects the Apache Airflow Keycloak provider (apache-airflow-providers-keycloak). The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. Because no allowlist res...

CVE-2026-76186

CVE-2026-76186 affects the Apache Airflow Keycloak auth manager (apache-airflow-providers-keycloak) in Airflow 3.3 and later . The root cause is that Keycloak access and refresh tokens are read from unauthenticated cookies and never validated against the subject in the signed Airflow session toke...

CVE-2026-82310

Apache Airflow 3 deployments using the FAB auth manager with Core API token authentication are affected by a flaw where deactivating a user account does not invalidate previously issued JWTs . The Core API continues to accept existing, unexpired tokens naming the deactivated account and allows th...

CVE-2026-86792

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings in a Kafka connection's extra field into Python callables via import_string with no allowlist , handing them to the confluent-kafka client. When the Kafka event producer is enabled (dag_run_events_enable...

CVE-2026-86462

Apache Airflow FAB provider contains a session-invalidation gap in the Admin user-edit PATCH endpoint . When a user's password is changed through this path, existing database-backed sessions are not invalidated because the PATCH handler never calls the session-invalidation helper. An attacker alr...

CVE-2026-73463

Arista EOS devices with multiple gNSI transports configured are subject to a race condition (CWE-362) in the gNSI Authz service that can cause a policy rotation to fail silently , allowing an authenticated user whose access was revoked to retain unauthorized access to gRPC interfaces. The issue w...

CVE-2026-82311

Apache Airflow FAB provider (apache-airflow-providers-fab) contains a flaw where resetting a user's password fails to invalidate that user's existing database-backed sessions . The root cause is a type mismatch: the cleanup routine compares the string _user_id that Flask-Login stores in the sessi...

CVE-2026-73445

Arista EOS is affected by a vulnerability in the gNSI (gRPC Network Security Interface) Authz Rotate RPC component, classified as CWE-20 (Improper Input Validation) . The bug may cause an incorrect Authz policy uploaded within an ongoing RPC stream to become the active policy, resulting in a poli...

CVE-2026-86465

Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to ...

CVE-2026-92081

fastify (a Node.js web framework) versions before 5.12.5 are vulnerable to a Denial of Service when a route registers a response trailer via reply.trailer() and is served over HTTP/2 . The root cause is that fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on...

CVE-2026-89792

CVE-2026-89792 is an out-of-bounds read vulnerability in the ksmbd (in-kernel SMB server) component of the Linux kernel . The root cause is insufficient validation of IPC share configuration payload sizes before consuming variable-length fields: the veto list parsing is unbounded, and the separat...