CVE-2026-73438

Arista EOS OSPFv3 vulnerability (CWE-617, Reachable Assertion ) allows an unauthenticated attacker on the same OSPFv3 broadcast domain to crash the Ospf3 agent with crafted packets, causing loss of all OSPFv3 adjacencies and potential routing disruption. Reported externally by Dravanet Inc. ; no ...

CVE-2026-85628

CVE-2026-85628 affects the DuoxMe application and VEO / VEO-XS Wi-Fi monitors (Fermax). During the pairing process, home Wi-Fi credentials are transmitted in cleartext over Wi-Fi Direct , allowing an attacker on the same Wi-Fi Direct network to intercept the network password. The vulnerability ex...

CVE-2026-84501

Apache ZooKeeper is vulnerable to operational log forgery via newline injection in the EnsembleAuthenticationProvider . An unauthenticated attacker can send a crafted add_auth("ensemble", ...) request containing newline characters; when the ensemble name does not match, the raw, unsanitized name ...

CVE-2026-84439

Apache ZooKeeper is affected by a log injection vulnerability in its audit logging subsystem. When audit logging is enabled (zookeeper.audit.enable=true), the server serializes attacker-controlled input—such as tab characters embedded in digest authentication usernames or crafted digest ACL ids v...

CVE-2026-79993

CVE-2026-79993 is an authorization bypass in Apache ZooKeeper (versions 3.9.0–3.9.5 and 3.8.0–3.8.6). The internal-only deleteContainer opcode (0x14/20) is processed without verifying the caller's ACL permissions, completely skipping both the session check and the DELETE ACL check enforced by the...

CVE-2026-59969

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are all enabled, the Java SSLSocket quorum path still accepts a CA-...

CVE-2026-59739

Apache ZooKeeper is vulnerable to an information disclosure via the SetWatches/SetWatches2 reconnect replay mechanism. The root cause is an incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799): the earlier patch added ACL checking to WatchManager.triggerWatch(), but DataTree.setWatches() still call...

CVE-2026-73436

CVE-2026-73436 affects Arista EOS when OSPFv2 segment routing is configured. A specially crafted OSPFv2 packet from an adjacent neighbor can trigger an unexpected OSPF process restart , causing a high availability impact (CVSS 3.1: 6.5 Medium; CVSS 4.0: 6.0 Medium). The root cause is linked to CW...

CVE-2026-73435

CVE-2026-73435 affects Arista EOS routers running OSPFv2 with cryptographic authentication (MD5 or SHA) on a broadcast interface with at least two neighbors. An unauthenticated attacker on the same broadcast segment can send a specially crafted OSPFv2 packet to cause adjacency flapping and packet...

CVE-2026-86466

Apache Airflow FAB provider (apache-airflow-providers-fab) contains an authentication bypass in the Authentik OAuth path of its FAB auth manager. The issuer and audience claims of the accepted id_token are not validated, allowing an attacker who holds a valid token minted by the same Authentik id...

CVE-2026-86443

DuoxMe for Android, in versions prior to 4.3.4 , stores sensitive credentials in cleartext , allowing an attacker with local access to the device to retrieve them and impersonate the user account . The CNA-assigned CVSS 4.0 score is 6.9 (MEDIUM) (AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/SC:H/VI:N/SI:H/VA:N/...

CVE-2026-19640

CVE-2026-19640 is an incorrect authorization flaw (CWE-863) in Arista EOS affecting the gNMI (gRPC Network Management Interface) . An authenticated user with gNMI access may receive incorrect authorization results, potentially gaining access beyond their assigned permissions. Arista discovered th...

CVE-2026-76187

Apache Airflow Keycloak provider contains a critical authentication flaw in its unauthenticated token endpoint. The endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not just the one configured for Airflow. Because no allowlist restricts val...

CVE-2026-76186

Apache Airflow Keycloak provider (v0.10.0 and earlier, used with Airflow 3.3+) contains a privilege escalation flaw: the Keycloak auth manager reads user identity from the signed Airflow session token but pulls the Keycloak access/refresh tokens from separate unauthenticated cookies , never verif...

CVE-2026-82310

Apache Airflow FAB provider (Airflow 3 with the FAB auth manager and Core API token authentication) has a flaw where deactivating a user does not revoke previously issued JWT tokens . An administrator's deactivation of an account silently fails to contain access: the Core API continues to accept ...

CVE-2026-86792

Apache Airflow Apache Kafka provider (versions 1.15.0 through before 2.0.0) contains an arbitrary code execution flaw in the Kafka event producer code path. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist and handed to...

CVE-2026-86462

Apache Airflow FAB provider has a session-invalidation flaw in the Admin user-edit PATCH endpoint : when a user's password is changed, existing database-backed sessions are not revoked because the PATCH code path never calls the session-invalidation helper. An attacker holding a copy of the victi...

CVE-2026-73463

Arista EOS devices with multiple gNSI transports configured are subject to a race condition (CWE-362) in the gNSI Authz service that can cause a policy rotation to fail silently , allowing an authenticated user whose access was revoked to retain unauthorized access to gRPC interfaces. The issue w...

CVE-2026-82311

In apache-airflow-providers-fab , the FAB password-reset command fails to invalidate existing database-backed sessions because it compares the string _user_id stored by Flask-Login against the user's integer database identifier—a comparison that always evaluates to false. An attacker holding a st...

CVE-2026-73445

Arista EOS is affected by a vulnerability in the gNSI (gRPC Network Security Interface) Authz Rotate RPC component, classified as CWE-20 (Improper Input Validation) . The bug may cause an incorrect Authz policy uploaded within an ongoing RPC stream to become the active policy, resulting in a poli...