CVE-2026-86106

This Arista VeloCloud Edge vulnerability (CWE-306, Missing Authentication for Critical Function) allows an unauthenticated attacker with Layer 2 access to the private HA interconnect to trigger sensitive HA peer functions without verification, potentially resulting in elevated command execution o...

CVE-2026-14916

Kong API Gateway Enterprise is affected by a JWT algorithm-confusion vulnerability in components that validate JWTs for MCP OAuth2 or DataKit integrations. The root cause is a failure to verify that the JWT signing algorithm is compatible with the type of key used for verification, allowing an un...

CVE-2026-77190

CVE-2026-77190 affects Arista EOS where an unauthenticated, network-adjacent attacker can send malformed PIM Sparse Mode messages to a device with both PIM SM and MLAG configured, causing the Pimsm agent to crash. Repeated attacks produce a sustained denial of service through continuous agent res...

CVE-2026-14917

CVE-2026-14917 is a SAML authentication bypass in the Kong API Gateway Enterprise SAML plugin. When the validate_assertion_signature option is explicitly set to false (it is enabled by default ), the plugin extracts the SAML identity from an unsigned assertion without verifying a valid cryptograp...

CVE-2026-86474

CVE-2026-86474 affects VEO and VEO-XS Wi-Fi monitors (by Fermax) in versions prior to 01.48.001 . The root cause is the lack of TLS certificate validation when downloading firmware updates, which allows an attacker to perform man-in-the-middle (MITM) attacks on the update channel. The CVSS 4.0 ba...

CVE-2026-76151

CVE-2026-76151 is an out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing within the QtNetwork module of Qt Group Qt 6.0.0 through 6.8.8 and 6.9.0 through 6.11.1 . A remote attacker can trigger a denial of service (application crash) by sending an excessively la...

CVE-2026-73468

CVE-2026-73468 affects Arista EOS platforms configured with PIM Sparse Mode (both IPv4 and IPv6, in default or non-default VRFs). A specially crafted packet can cause premature expiry of multicast forwarding state , resulting in temporary loss of multicast traffic forwarding. The underlying weakn...

CVE-2026-73440

Arista EOS devices with SNMPv3 configured may expose user credentials as a one-way hashed key in running and sanitized configurations when using the legacy CLI syntax (without the key format). An authenticated user could leverage this to perform unauthorized SNMP table reads or send fraudulent ...

CVE-2026-73469

Arista EOS on 7050X4 and 7358X4 series platforms running EOS 4.35.4M or below in the 4.35.x train is affected by a loose Unicast Reverse Path Forwarding (uRPF) bypass (CWE-863). When loose-mode uRPF is configured on an interface, certain traffic that should be dropped based on route verification ...

CVE-2026-89793

CVE-2026-89793 affects the Linux kernel ublk subsystem. The function ublk_ch_mmap() rejects mmap requests with VM_WRITE set but fails to clear VM_MAYWRITE on the resulting read-only mapping. An unprivileged userspace daemon can exploit this by mapping the per-queue command buffer with PROT_READ a...

CVE-2026-73453

CVE-2026-73453 is a critical (CVSS 3.1: 10.0) code injection vulnerability (CWE-94 ) in Arista EOS configured with the P4Runtime service. An unauthenticated attacker who can reach the P4Runtime gRPC endpoint (port 9559) can craft a malicious packet during session initiation to achieve arbitrary c...

CVE-2026-73455

CVE-2026-73455 affects Arista EOS where a specially crafted network packet can cause the OSPFv3 agent to restart unexpectedly, resulting in high availability impact (CVSS 3.1: 7.5). The root cause is classified as CWE-130 (Improper Handling of Length Parameter Inconsistency). Exploitation require...

CVE-2026-73438

Arista EOS OSPFv3 vulnerability (CWE-617, Reachable Assertion ) allows an unauthenticated attacker on the same OSPFv3 broadcast domain to crash the Ospf3 agent with crafted packets, causing loss of all OSPFv3 adjacencies and potential routing disruption. Reported externally by Dravanet Inc. ; no ...

CVE-2026-85628

CVE-2026-85628 affects the DuoxMe application and VEO / VEO-XS Wi-Fi monitors (Fermax). During the pairing process, home Wi-Fi credentials are transmitted in cleartext over Wi-Fi Direct , allowing an attacker on the same Wi-Fi Direct network to intercept the network password. The vulnerability ex...

CVE-2026-84501

Apache ZooKeeper is vulnerable to operational log forgery via newline injection in the EnsembleAuthenticationProvider . An unauthenticated attacker can send a crafted add_auth("ensemble", ...) request containing newline characters; when the ensemble name does not match, the raw, unsanitized name ...

CVE-2026-84439

Apache ZooKeeper is affected by an audit log injection vulnerability in zookeeper_audit.log. When audit logging is enabled (zookeeper.audit.enable=true), two attack vectors exist: an unauthenticated attacker can embed tab characters (\t) in a digest authentication username, and an authenticated c...

CVE-2026-79993

Apache ZooKeeper versions 3.9.0–3.9.5 and 3.8.0–3.8.6 are affected by an authorization bypass in the deleteContainer opcode (0x14/20). This opcode is treated as internal-only, yet its request path skips both the session check and the DELETE ACL check enforced by the regular delete path. As a resu...

CVE-2026-59969

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum, zookeeper.fips-mode, ssl.quorum.hostnameVerification, and ssl.quorum.clientHostnameVerification are all enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate w...

CVE-2026-59739

Apache ZooKeeper has an information disclosure vulnerability in the DataTree.setWatches() reconnect replay handler (SetWatches/SetWatches2). This is an incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799): the prior patch added an ACL check in WatchManager.triggerWatch(), but DataTree.setWatches() ...

CVE-2026-73436

CVE-2026-73436 affects Arista EOS when OSPFv2 segment routing is configured. A specially crafted OSPFv2 packet from an adjacent neighbor can trigger an unexpected OSPF process restart , causing a high availability impact (CVSS 3.1: 6.5 Medium; CVSS 4.0: 6.0 Medium). The root cause is linked to CW...