CVE-2026-59739

Apache ZooKeeper is vulnerable to an information disclosure via the SetWatches/SetWatches2 reconnect replay mechanism. The root cause is an incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799): the earlier patch added ACL checking to WatchManager.triggerWatch(), but DataTree.setWatches() still call...

CVE-2026-73436

CVE-2026-73436 affects Arista EOS when OSPFv2 segment routing is configured. A specially crafted OSPFv2 packet from an adjacent neighbor can trigger an unexpected OSPF process restart , causing a high availability impact (CVSS 3.1: 6.5 Medium; CVSS 4.0: 6.0 Medium). The root cause is linked to CW...

CVE-2026-73435

CVE-2026-73435 affects Arista EOS routers running OSPFv2 with cryptographic authentication (MD5 or SHA) on a broadcast interface with at least two neighbors. An unauthenticated attacker on the same broadcast segment can send a specially crafted OSPFv2 packet to cause adjacency flapping and packet...

CVE-2026-86466

Apache Airflow FAB provider (apache-airflow-providers-fab) contains an authentication bypass in the Authentik OAuth path of its FAB auth manager. The issuer and audience claims of the accepted id_token are not validated, allowing an attacker who holds a valid token minted by the same Authentik id...

CVE-2026-86443

DuoxMe for Android, in versions prior to 4.3.4 , stores sensitive credentials in cleartext , allowing an attacker with local access to the device to retrieve them and impersonate the user account . The CNA-assigned CVSS 4.0 score is 6.9 (MEDIUM) (AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/SC:H/VI:N/SI:H/VA:N/...

CVE-2026-19640

CVE-2026-19640 is an incorrect authorization flaw (CWE-863) in Arista EOS affecting the gNMI (gRPC Network Management Interface) . An authenticated user with gNMI access may receive incorrect authorization results, potentially gaining access beyond their assigned permissions. Arista discovered th...

CVE-2026-76187

Apache Airflow Keycloak provider contains a critical authentication flaw in its unauthenticated token endpoint. The endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not just the one configured for Airflow. Because no allowlist restricts val...

CVE-2026-76186

Apache Airflow Keycloak provider (v0.10.0 and earlier, used with Airflow 3.3+) contains a privilege escalation flaw: the Keycloak auth manager reads user identity from the signed Airflow session token but pulls the Keycloak access/refresh tokens from separate unauthenticated cookies , never verif...

CVE-2026-82310

Apache Airflow FAB provider (Airflow 3 with the FAB auth manager and Core API token authentication) has a flaw where deactivating a user does not revoke previously issued JWT tokens . An administrator's deactivation of an account silently fails to contain access: the Core API continues to accept ...

CVE-2026-86792

Apache Airflow Apache Kafka provider (versions 1.15.0 through before 2.0.0) contains an arbitrary code execution flaw in the Kafka event producer code path. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist and handed to...

CVE-2026-86462

Apache Airflow FAB provider has a session-invalidation flaw in the Admin user-edit PATCH endpoint : when a user's password is changed, existing database-backed sessions are not revoked because the PATCH code path never calls the session-invalidation helper. An attacker holding a copy of the victi...

CVE-2026-73463

Arista EOS devices with multiple gNSI transports configured are subject to a race condition (CWE-362) in the gNSI Authz service that can cause a policy rotation to fail silently , allowing an authenticated user whose access was revoked to retain unauthorized access to gRPC interfaces. The issue w...

CVE-2026-82311

In apache-airflow-providers-fab , the FAB password-reset command fails to invalidate existing database-backed sessions because it compares the string _user_id stored by Flask-Login against the user's integer database identifier—a comparison that always evaluates to false. An attacker holding a st...

CVE-2026-73445

Arista EOS is affected by a vulnerability in the gNSI (gRPC Network Security Interface) Authz Rotate RPC component, classified as CWE-20 (Improper Input Validation) . The bug may cause an incorrect Authz policy uploaded within an ongoing RPC stream to become the active policy, resulting in a poli...

CVE-2026-86465

CVE-2026-86465 affects the Akeyless secrets backend in Apache Airflow's apache-airflow-providers-akeyless. A team-scope guard bypass allows a Dag author scoped to one team to supply a Variable key containing a path separator , causing the backend to resolve a secret belonging to a different team....

CVE-2026-92081

fastify (a Node.js web framework) versions before 5.12.5 are vulnerable to a Denial of Service when a route registers a response trailer via reply.trailer() and is served over HTTP/2 . The root cause is that fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on...

CVE-2026-89792

CVE-2026-89792 is an out-of-bounds read vulnerability in the ksmbd (in-kernel SMB server) component of the Linux kernel . The root cause is insufficient validation of IPC share configuration payload sizes before consuming variable-length fields: the veto list parsing is unbounded, and the separat...

CVE-2026-2380

CVE-2026-2380 affects Arista EOS when OpenConfig-related services (gNMI, gNSI, RESTCONF, or NETCONF) are enabled. The OpenConfig/Octa agent may unintentionally log sensitive requests and responses—such as CLI commands containing passwords or OpenConfig YANG secret-key leafs—to local agent logs or...

CVE-2026-89791

CVE-2026-89791 is a use-after-free race condition in the Linux kernel's perf subsystem . The root cause is that perf_mmap_close() drops rb->mmap_count without holding event->mmap_mutex, allowing a concurrent perf_mmap_rb() revival path to free a newly allocated ring buffer that another proc...

CVE-2026-89790

CVE-2026-89790 is a divide-by-zero vulnerability in the Linux kernel IPv6 routing code, specifically in rt6_multipath_rebalance() (net/ipv6/route.c). Because RTM_NEWROUTE operates without the RTNL lock, a concurrent update to ignore_routes_with_linkdown can cause the first pass to compute a zero ...