2026-09-16
A stored/cross-context cross-site scripting flaw (CWE-79) in GitLab CE/EE's Content Editor allows an unauthenticated attacker to run arbitrary JavaScript in a targeted user's session, because pasted HTML is not sanitized properly. All GitLab Community and Enterprise Edition versions from 19.0 up to (but not including) 19.1.8, 19.2.6, and 19.3.2 are affected. Publicly available exploit information exists via a HackerOne report, but the issue is not listed in CISA KEV and its low EPSS-relevant profile (CVSS 4.7, AC:H, UI:R) places it in the moderate rather than emergency tier.
Command injection in the gRPC Network Security Interface (gNSI) Credentialz service of Arista EOS allows an authenticated, low-privileged attacker with access to the gRPC management endpoint to send a crafted request that modifies a target account's properties, potentially granting that account elevated privileges or broader access than an administrator intended (CVSS 4.0 base 8.6; assessed CVSS 3.1 8.6, AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N). Exposure is conditional: the device must be running an affected EOS maintenance train (4.30.0F through 4.36.0.1F) with gNSI Credentialz configured, a non-default management feature, and the attacker must already hold authenticated access to that endpoint, making this a privilege-escalation-from-foothold rather than an anonymous remote compromise. A vendor patch is available per the Arista advisory; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is narrower in practice than the raw score suggests because of the configuration prerequisite.
Cross-site request forgery in the WNC T-Mobile 5G Box IDU router (portal.cgi) lets a remote attacker drive privileged actions through an already-authenticated administrator's browser, because the anti-CSRF check accepts any value supplied in the csrf_token_value parameter. The flaw affects firmware versions below 1.1.0.651412, is rated 8.4 under CVSS 4.0 (AV:A/PR:N/UI:A, high confidentiality and integrity impact, low availability impact), and requires the victim to be logged into the router portal while being lured to an attacker-controlled page reachable over the adjacent network. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a fixed firmware build, so risk is real but conditional rather than an emergency patch-now scenario.
Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker who controls or spoofs the upstream DNS response (PR:N/UI:N) gradually overwrite heap memory, with the reliable outcome being a crash and remote code execution possible only on certain systems and compilation options that lack hardening. The flaw is scored CVSS 8.4 (CVSS:4.0) and by the independent assessment as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, with the high attack complexity reflecting heavy dependence on heap layout and non-deterministic results. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no KEV listing or EPSS signal is present, so this is a genuine but not-yet-urgent priority for internet-facing recursive resolvers.
Improper authorization checks in GitLab CE/EE's Generic Package Registry (CWE-862) allow an authenticated user holding developer-role permissions to substitute the content of an existing package file and to hide packages from their legitimate owners. The flaw affects all GitLab Community and Enterprise Editions from 13.9 up to the fixed releases 19.1.8, 19.2.6 and 19.3.2, meaning the exposure window spans multiple major release lines and any long-lived install not patched in this cycle. Impact is integrity-only (CVSS 4.3, AV:N/PR:L/UI:N) - an attacker cannot read or delete data or crash the instance, but they can silently corrupt or conceal artifacts that downstream users and CI pipelines trust; publicly available exploit detail has been published via a HackerOne report.
GitLab CE/EE 13.0 and later (before 19.1.8, 19.2.6 and 19.3.2) fails to properly validate group URL slugs during namespace transfers, allowing any authenticated user to induce a slug collision that leaves the legitimate owners of another group unable to modify that group's settings. The flaw is an availability-only issue (CVSS 4.3, C:N/I:N/A:L) rather than a data-disclosure or code-execution bug, but publicly available exploit detail exists via the linked HackerOne report, and the CWE-862 classification indicates the transfer workflow bypasses the authorization checks that should protect the target namespace. No CISA KEV listing or EPSS score was supplied, so active exploitation is not confirmed.
Improper authorization controls in GitLab Enterprise Edition's compliance framework management allow an authenticated user holding the Security Manager role to execute arbitrary CI/CD jobs and reach protected CI/CD variables inside group projects. Affected are GitLab EE 18.11 through 19.1.7, 19.2.x before 19.2.6, and 19.3.x before 19.3.2, with fixes published in 19.1.8, 19.2.6, and 19.3.2. Exploit details are publicly available via a HackerOne report, and GitLab is credited as the reporter, though the issue is not listed in CISA KEV and no EPSS estimate was supplied.
An out-of-bounds write in Arista VeloCloud Edge and VeloCloud Gateway affects the VCMP tunnel protocol when it processes tunneled IP fragments, causing the affected process to crash and restart and briefly disrupting traffic on the affected SD-WAN node. Exploitation requires the attacker to already be an authenticated overlay neighbor with an established VCMP peer relationship to the target (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) - internet hosts that are unauthenticated and cannot form an overlay peer relationship cannot reach the vulnerable logic. No public exploit code has been identified at time of analysis; the impact is bounded to a temporary availability loss, with no code execution or data compromise demonstrated.
Improper authorization on the IODD file upload endpoint of multiple Pepperl+Fuchs ICE2 and ICE3 IO-Link master devices, as well as Phoenix Contact IOL MA8 PN DI8 units, permits any low-privileged authenticated remote user to upload IO-Link Device Description (IODD) files without the privilege level required for that operation. Successful exploitation can silently alter how connected IO-Link sensors and actuators are configured or interpreted by the master, or crash the device entirely by supplying malformed IODD content. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Missing cryptographic signature verification of firmware update packages in FERMAX VEO and VEO-XS Wi-Fi monitors running firmware prior to 01.48.001 allows anyone who controls the delivery of an update to install unauthorized, attacker-supplied firmware on the device. The attacker must be on the adjacent network (typically the same LAN or Wi-Fi segment as the monitor) and positioned to substitute or serve the update package, such as through an on-path man-in-the-middle position or a rogue update server; no authentication or user interaction is required once that delivery-control precondition is met, and the flaw is not exploitable across the open Internet. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); devices already updated to 01.48.001 or later are not affected.
Signature-verification bypass in Kong API Gateway Enterprise lets an unauthenticated remote attacker present a forged JWT that the gateway accepts as valid, defeating token-based authentication for the MCP OAuth2 and DataKit integration code paths. The vulnerable logic fails to confirm that the JWT's declared signing algorithm is compatible with the key type actually used for verification, so an attacker who can reach a protected endpoint that relies on these integrations can slip through as an authenticated principal; the independent assessment scopes the impact to the backend resources the gateway protects (C:H/I:H under a changed-scope CVSS:3.1 vector) rather than to the gateway host itself. Exposure is gated by configuration - gateways that do not enable MCP OAuth2 or DataKit JWT validation are not reachable - and no public exploit code or confirmed active exploitation was identified at time of analysis.
SAML authentication bypass in Kong Enterprise Gateway allows an unauthenticated remote attacker to impersonate arbitrary users, including administrators, by submitting a crafted SAML response containing an unsigned assertion. Exploitation is strictly gated by a non-default configuration: the Kong SAML plugin's validate_assertion_signature option must have been explicitly set to false, since it defaults to true - default deployments are not affected. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; patch status is Vendor-released patch: Kong Gateway 3.15.0.3.
Firmware update downloads on Fermax VEO and VEO-XS Wi-Fi monitors (DUOX Plus range) running firmware prior to 01.48.001 are not validated against a TLS certificate, so an attacker who already holds a man-in-the-middle position on the network segment carrying that traffic can deliver a spoofed update and have the device install it. The practical result is full loss of integrity, confidentiality and availability on the device, since attacker-supplied firmware runs with the monitor's privileges; the assessed severity is 7.7 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), and exploitation is conditional: the attacker must be network-adjacent, must catch or induce a firmware update event, and cannot succeed against monitors already updated to 01.48.001 or later. This is a supply-chain/update-integrity weakness rather than a drive-by remote takeover, and no device credentials are required (PR:N).
Mis-enforced authorization in Arista EOS allows an authenticated gNMI user to read or write management paths that an active gNSI Pathz policy is meant to deny, specifically when a single Pathz policy contains both a group rule and a user rule referencing the same path. Exposure is limited to EOS deployments that combine OpenConfig, a running gNMI server, and gNSI Pathz authorization - a non-default, advanced management-plane configuration - and the attacker must already hold valid gNMI credentials, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (confidentiality and integrity High, no availability impact). No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV); the supplied CVSS 4.0 score of 7.7 overstates day-to-day risk given the narrow prerequisite stack.
Blind SQL injection in Themeum's WP Mega Menu WordPress plugin (versions through 1.4.2) allows an attacker who already holds a high-privilege, administrator-level account to feed crafted input into a vulnerable plugin parameter that is not neutralized before reaching a SQL query, letting them infer database contents one query at a time. Exploitation is privilege-gated (CVSS PR:H) and the injection is blind, so extraction is slow and no anonymous or low-privileged user can reach it; user interaction is not required (UI:N). The CVE carries a CVSS 3.1 base score of 7.6, but the effective risk is lower than that number implies given the authentication prerequisite, and no public exploit code has been identified at time of analysis.
Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-framed DNS response encounters an RRSet whose owner name reaches the 255-byte maximum, crashing the resolver process and yielding a denial of service (availability-only impact, C:N/I:N/A:H). An attacker must either operate an authoritative name server that the victim resolver queries or hold an on-path position to tamper with an incoming DNS response, and the malicious answer must be delivered over TCP, be large, and carry the maximal-length owner name; crafting and delivering that payload raises practical complexity above the vendor's AC:L rating, which is why our assessment uses AC:H. No public exploit code or confirmed active exploitation has been identified at time of analysis, and because canonicalisation runs before DNSSEC validation, signature validation does not mitigate the issue. NLnet Labs has published an advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt.
Path traversal in the PHP web management interface of Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL MA8 IO-Link master devices allows unauthenticated remote attackers to read arbitrary files via the /index.php/view_uploaded_iodd_file endpoint. The most critical disclosed impact is exfiltration of the SSH server's private key, which could enable decryption of captured SSH sessions or device impersonation. Three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the vulnerability affects a shared firmware/software base across multiple vendor OEM implementations. No public exploit or KEV listing identified at time of analysis.
Unauthenticated attackers can read the complete AI booking conversation transcript of any Bookly customer — including names, email addresses, phone numbers and appointment details — because the plugin's 'conversation_id' parameter is never checked against an owner, and conversation IDs are sequential integers that can simply be incremented. The same endpoint also allows arbitrary messages to be injected into a victim's conversation, which are then replayed to the Cloud AI worker together with the full private history, enabling data poisoning and prompt-injection against the assistant. The flaw affects all versions of the Online Scheduling and Appointment Booking System – Bookly plugin through 28.1; no public exploit code or CISA KEV listing was identified at time of analysis.
Improper cryptographic signature verification in the VeloCloud Edge (Arista, formerly VMware/Broadcom SD-WAN) software update workflow allows an attacker who can either upload packages to VeloCloud Orchestrator or authenticate directly to an Edge to install unauthorized software on the appliance. Because the update workflow does not constrain which digest algorithm is used to verify artifacts, a bundle signed with an unexpected or weak digest can be accepted as legitimate, resulting in arbitrary code execution with the privileges of the update process on the SD-WAN edge node. No public exploit code and no CISA KEV listing were present in the provided intelligence, although the required access level (CVSS 4.0 PR:H) means the flaw is most dangerous to insiders or anyone who has already compromised an operator account.
OS command injection in Arista VeloCloud Edge management and configuration workflows allows input supplied through those workflows to be interpreted as an operating-system command, resulting in command execution with elevated privileges on the appliance. Exploitation requires a high-privileged management request or the ability to write a configuration value, so this is primarily a privileged-insider, compromised-admin-account, or post-compromise escalation risk rather than an unauthenticated internet-facing flaw. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied with the record.
Command injection via the `/api/datastorage/data` REST API endpoint in Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL-MA8 IO-Link master devices allows an authenticated administrator to execute arbitrary OS commands with root privileges by sending a crafted HTTP PUT request. The flaw spans multiple hardware variants from both vendors and is disclosed across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating broad impact across related product families. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Command injection on Pepperl+Fuchs ICE2/ICE3 series IO-Link Master devices and OEM-equivalent variants (Phoenix Contact IOL-MA8, and others) allows an authenticated remote admin to execute arbitrary OS commands as root via a crafted GET request to the /api/datastorage/data endpoint. The vulnerability is reported across at least three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating coordinated multi-vendor OEM disclosure spanning Pepperl+Fuchs, Phoenix Contact, and additional industrial automation suppliers. No public exploit code or active exploitation has been identified at time of analysis, but the industrial OT context raises availability and safety concern disproportionate to a purely IT risk framing.
Command injection in the web management API of Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL MA8 enables an authenticated admin-level attacker to execute arbitrary OS commands as root via a crafted PUT request to the /api/iodd/config endpoint. All firmware versions of at least nine Pepperl+Fuchs ICE2/ICE3 hardware variants and the Phoenix Contact IOL MA8 PN DI8 are confirmed affected across three CERT@VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). No public exploit code or active exploitation is identified at time of analysis, but full root compromise of an industrial field device represents a significant ICS/OT risk.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and related Phoenix Contact hardware allows a remote attacker holding valid admin credentials to execute arbitrary OS commands with root privileges via a crafted GET request to the /api/iodd/config endpoint. The vulnerability is confirmed by three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating it spans multiple vendor product lines and firmware variants. No public exploit or active exploitation is identified at time of analysis, but root-level code execution on OT network edge devices represents a significant lateral-movement and persistence risk in industrial environments.
Command injection in the Pepperl+Fuchs ICE2/ICE3 IO-Link Master firmware - and functionally equivalent Phoenix Contact IOL-MA8 variants - allows a remote admin-authenticated attacker to achieve root-level OS command execution by sending a crafted DELETE request to the `/api/status/data` REST API endpoint. All currently listed firmware versions across the ICE2 and ICE3 product lines are affected, with no upper version bound in NVD CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor-assigned CVSS 7.2 appropriately reflects the PR:H prerequisite that meaningfully gates exploitation to scenarios where admin credentials are already available to the attacker.
Unauthenticated stored cross-site scripting in the WP-Lister Lite for eBay WordPress plugin affects every release up to and including 3.8.9, allowing an attacker to inject arbitrary JavaScript through the plugin's AJAX cron handler request parameter because input is not sanitized and output is not escaped. The injected payload is persisted and executes in the browser of any user — including administrators — who later views the affected page, enabling session theft, credential harvesting, or full site takeover via an admin session. No public exploit code has been identified and the flaw is not listed in CISA KEV, but the unauthenticated network-reachable attack path makes it a realistic target for automated scanning; an upstream fix was committed in WordPress.org plugin changeset 3638342.
WNC's T-Mobile 5G Box IDU router (firmware versions below 1.1.0.651412) exposes the wnc_maccheck.cgi endpoint without any authentication, letting a device on the same network segment read sensitive configuration data - including the administrator web password and the WiFi passphrase. Exploitation requires network adjacency (CVSS AV:A) such as a rogue or legitimate WiFi client or a wired LAN host; it is not reachable over the internet by default, but no credentials or user interaction are needed once that position is obtained. The result is a direct path to full administrative takeover of the router, which is why the assessed confidentiality impact is high despite the bounded attack surface. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available.
Premature expiry of multicast forwarding state in Arista EOS can be triggered by a specially crafted packet sent by an unauthenticated attacker who is positioned on the same Layer 2 or otherwise adjacent network segment, causing temporary loss of multicast traffic on the affected interfaces. This is an availability-only denial of service (CVSS 4.0 reports VA:H with VC:N/VI:N; the CVSS 3.1 assessment is AV:A/AC:L/PR:N/UI:N with impact limited to A:H), so the 'Information Disclosure' tag attached to the record does not reflect the actual impact. Exploitation additionally requires that multicast forwarding (PIM/IGMP) is actively configured on the targeted interface - a default, non-multicast deployment is not exposed - and the disruption is transient, since traffic resumes once forwarding state is rebuilt. No public exploit code and no confirmed active exploitation were identified at time of analysis.
QDomDocument, Qt's DOM-based XML parser, crashes when processing maliciously crafted XML with extreme element nesting depth, exploiting uncontrolled recursion (CWE-674) to exhaust the call stack and terminate the host application. Any Qt-based application that passes attacker-influenced content to QDomDocument is affected across the Qt version range identified by cpe:2.3:a:qt:qt:*. No public exploit or active exploitation has been identified at time of analysis; the Qt Project has issued a patch via its code review platform.
Improper validation of parameters in GitLab CE/EE's Terraform state upload functionality allows an authenticated user holding project-level permissions to read restricted file contents on the server or cause denial of service. Affected releases are all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, with fixes published in the 19.3.2 patch release. Public exploit details exist via a HackerOne report, but the CVSS base score is only 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N); there is no CISA KEV listing and no EPSS data was provided.
The @jitsi/electron-sdk package before 10.0.5 bridges the getDesktopSources() API into the meeting page and lets any script running there invoke the jitsi-screen-sharing-get-sources IPC route to pull desktop thumbnails of every screen and window, without a getDisplayMedia() picker being open and without any OS-level screen-recording permission prompt or user consent. The flaw (CWE-862, missing authorization) affects the Jitsi Meet Electron desktop client and any application embedding the SDK, and it is reachable unauthenticated from inside a meeting by a malicious participant or injected script. The vendor fix is a merged upstream PR (PR #516) shipping in 10.0.5; no public exploit code or CISA KEV listing was identified at time of analysis.
A crafted multi-packet sequence sent by an unauthenticated attacker on the same OSPFv3 broadcast domain can force the Ospf3 agent on Arista EOS devices to restart, dropping all OSPFv3 adjacencies and potentially disrupting routing across the wider OSPF domain until the agent recovers. The flaw only affects EOS platforms where OSPFv3 is explicitly configured, and exposure is limited to link-local/L2-adjacent positions rather than routable Internet reach; exploitation is a genuine availability-only issue (CWE-617, reachable assertion), with no confidentiality or integrity impact and no public exploit identified at time of analysis, and Arista states it is not aware of malicious exploitation in customer networks.
Cleartext transmission of home Wi-Fi credentials during Wi-Fi Direct pairing between the Fermax DuoxMe mobile app and VEO/VEO-XS Wi-Fi monitors allows an unauthenticated attacker on the adjacent Wi-Fi Direct network to intercept the home network password while onboarding is in progress. Exploitation affects deployments running DuoxMe before 4.3.4 or monitor firmware before 01.50.001, and requires the attacker to be within RF range and listening during the narrow pairing window (UI:P, AT:P), with no public exploit identified at time of analysis. The result is a bounded confidentiality compromise of the home WLAN credential rather than remote code execution or device takeover; integrity and availability of the monitor and app are not affected.
Crafted OSPFv2 packets sent by an unauthenticated attacker on the same broadcast segment can force adjacency flapping, packet loss, and wider routing disruption on Arista EOS switches and routers that have OSPFv2 configured together with OSPFv2 authentication. Affected maintenance trains identified in EUVD are EOS below 4.33.0F and the 4.33.x (through 4.33.9M), 4.34.x (through 4.34.7M), 4.35.x (through 4.35.5M), and 4.36.x (through 4.36.1F) branches; the CVSS 4.0 base score is 7.0 (AV:A/AC:L/AT:P/PR:N/UI:N, VC:N/VI:N/VA:H/SC:N/SI:N/SA:H), and our independent 3.1 assessment scores it AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H, so the impact is strictly availability - no confidentiality or integrity loss - and the 'Information Disclosure' tag attached to this record is misleading. No CISA KEV listing is present and no public exploit code has been identified at time of analysis; authentication requirements are unauthenticated per the PR:N vector, with the compensating prerequisite being adjacency to the OSPFv2 segment rather than any credential.
Crafted packets injected onto the MLAG Dual Primary Detection segment can trick an Arista EOS switch into falsely concluding it is in a dual-primary condition and err-disabling its interfaces, abruptly cutting off traffic for everything downstream of that switch. Exploitation needs only layer-2 adjacency to the Dual Primary Detection segment with no authentication (CVSS 4.0 AV:A/PR:N/UI:N), but it is gated by a precondition: the MLAG primary switch must fail while the crafted packets are present, so this is a conditional denial-of-service rather than a mass-exploitable remote attack. Affected EOS branches include 4.33.x, 4.34.x, 4.35.x and 4.36.x; a vendor patch is available and no public exploit code or active exploitation has been identified at time of analysis.
Let me synthesize. Product: Arista EOS. Key data: CVSS 4.0 vector: AV:A (adjacent), AC:H, AT:P (attack requirements present), PR:N, UI:N, VC:N, VI:N, VA:H, SC:N, SI:N, SA:H. CVSS score 7.0. CWE-863 (Incorrect Authorization) — hmm, that's a bit odd for a malformed packet handling issue; likely a mismatch worth flagging in confidence notes. Tags: "Authentication Bypass" — that seems mislabeled; the description is about malformed IS-IS LSP PDU causing graceful restart procedure termination — an availability issue, not auth bypass. Also CWE-863 mismatch. I could emit a data_quality_flag mislabeled_tag "Authentication Bypass". Hmm — is that highly confident? The description says unauthenticated attacker, but it's not authentication bypass — it's a protocol-level denial of service. CWE-863 incorrect authorization. The tag "Authentication Bypass" is arguably wrong. I think it's defensible to flag as mislabeled_tag with medium/high confidence. Let me consider: the rule says only emit flag when input metadata clearly wrong and verifiable. The tag "Authentication Bypass" doesn't match a DoS/availability issue in IS-IS graceful restart. But the CWE is 863 = Incorrect Authorization, which aligns with the tag... though CWE-863 for IS-IS graceful restart is questionable. Hmm. Given the CWE given is 863, the tag isn't clearly wrong relative to provided metadata. I'll be cautious: maybe emit a medium-confidence flag. Actually the guidance says empty array is common and correct. But there's genuine mismatch: description is a malformed packet causing premature termination of graceful restart = availability. No authentication bypass occurs. I'll emit one flag with medium confidence. Hmm, risk of being penalized. I think it's reasonable and defensible... Let me lean toward emitting it since the description clearly describes DoS via malformed packet with no authorization bypass. Actually, tagging "Authentication Bypass" would cause wrong categorization. I'll emit with medium confiden
Let me synthesize. CVE-2026-73459: Arista EOS IS-IS LSP purge via crafted IS-IS LSP PDU. Unauthenticated attacker with adjacency/adjacent network access. CVSS 4.0: AV:A (adjacent), AC:L, AT:P (attack requirements present), PR:N, UI:N, VC:N, VI:N, VA:H, SC:N, SI:N, SA:H. CWE-354: Improper Validation of Integrity Check Value. Hmm, CWE-354 is "Improper Validation of Integrity Check Value". Actually CWE-354 is "Improper Validation of Integrity Check Value". Yes. So the crafted LSP with invalid/wrong checksum (IS-IS LSP checksum) isn't validated, causing legitimate LSP to be purged (sequence number manipulation / LSP purge). Actually the scenario: attacker injects crafted IS-IS LSP PDU that purges a legitimate LSP from the link-state database — likely by spoofing LSP with same LSP ID (source ID + pseudonode ID) with... Actually removal could happen by a zero-lifetime LSP or by "purge" mechanism with Remaining Lifetime = 0. In IS-IS, an LSP with remaining lifetime 0 is purged. So crafted LSP with matching LSP ID and Remaining Lifetime 0 plus invalid checksum being accepted → purges legitimate LSP. AV:A — adjacent network — requires attacker on same broadcast segment / L2 adjacency, must be able to send IS-IS PDUs (L2 multicast, no auth if authentication not configured). AT:P — attack requirements present: need to be on an IS-IS enabled link/adjacency; possibly need to be able to form adjacency or at least inject raw L2 frames. PR:N — no auth (if IS-IS authentication is not configured). But PR:N in CVSS 4.0 means none — no privileges required. However, if IS-IS authentication is configured, injection requires the auth key — hence AT:P captures the requirement. EPSS: not given. KEV: not given (not listed). POC: not given. Patch: EOS 4.36.0 ≤4.36.1F affected; advisory 0160 available. Fix version not explicitly given in input — the advisory presumably lists fixed versions. I should not invent. So: "Patch available per vendor advisory" — advisory SAF-0160 at arista.com.
Unauthenticated attackers positioned on the same Layer 2 broadcast segment as an Arista EOS device can force that device to tear down an established IS-IS adjacency by sending a crafted IS-IS Hello P
Loose-mode Unicast Reverse Path Forwarding (uRPF) on certain Arista EOS platforms can fail to drop traffic that the configured source-address verification should have rejected, so packets that ought to be filtered are still processed and forwarded by the switch or router. Only devices running Arista EOS on one of the specific (unnamed) affected platforms and explicitly configured with loose uRPF are exposed - default deployments that do not enable uRPF are not affected, and there is no confidentiality or availability impact, only a loss of filter integrity. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor CVSS score of 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) is well calibrated to this narrow, configuration-dependent filtering failure.
Local attackers with authenticated access can retrieve cleartext-stored credentials from the Fermax DuoxMe Android app versions prior to 4.3.4 and impersonate the user account. This CWE-312 vulnerability requires local access to the device, and on non-rooted devices the app sandbox normally protects the data, so root or device-level access is the practical prerequisite. No public exploit code has been identified at time of analysis, and the risk is assessed as a modest-severity local issue.
An incorrect authorization policy can become active on Arista EOS devices through the gRPC Network Security Interface (gNSI) Authz Rotate RPC, allowing a high-privilege authenticated remote attacker to alter the device's active Authz policy. This integrity-only issue is rated CVSS 4.0 6.9 (Medium; CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) and requires privileged gNSI management credentials; the Bootz service is explicitly unaffected. No public exploit identified at time of analysis, and Arista reports the issue was discovered internally with no known malicious use in customer networks.
Unauthenticated remote attackers can force Siemens WTV676-HB6035 and WTV776-HB6035 industrial web interface devices into protection mode by sending crafted input that exploits improper validation of data received from backend services. Once triggered, the device loses remote connectivity and web access, effectively causing an operational disruption. No public exploit code exists at time of analysis, and this is not listed in CISA KEV.
Unbounded buffering of unacknowledged KV-transfer acknowledgements in the MoRIIO connector of vLLM 0.26.0 and 0.27.0 allows a remote, unauthenticated client to grow worker memory indefinitely and degrade or crash LLM inference serving. The root cause is CWE-400 uncontrolled resource consumption in moriio_connector.py, where acknowledgements whose transfer mapping is not yet populated are appended to _pending_unmapped_acks with no TTL or size cap across request_finished, get_finished and _handle_release_message. Impact is availability-only (CVSS 4.0 base 6.9, AV:N/AC:L/PR:N/UI:N/VA:L); no public exploit code and no CISA KEV
Server-side request forgery in the a2ui agent SDK's FileResolver (a2ui 0.10.0 through 0.10.7) allows a remote, unauthenticated attacker to make the agent process issue attacker-influenced outbound HTTP requests via the httpx.get call in file_resolver.py, enabling access to internal services, cloud metadata endpoints, and other resources reachable from the agent host. Exploitation requires that the deployment actually uses the FileResolver extension's HTTP path and that an attacker can supply or influence the file reference (file_id/URL) the agent resolves; the impact is bounded to server-initiated requests rather than code execution, and the affected product's deployment footprint is very small. Vendor patching is available as an upstream commit/PR, and no public exploit code was identified at time of analysis; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (CVSS 4.0 base 6.9).
Hard-coded cryptographic key exposure in Qualitysoft QND's Windows client allows any local authenticated user to decrypt and recover administrator credentials - including login ID and password - stored or processed by the PC management software. All three product lines (QND Advance, QND Premium, QND Standard) through their respective current versions are affected. No public exploit or active exploitation has been identified, but the attack is low-complexity and requires only a standard Windows session on a machine where the QND client is installed.
Unbound versions 1.22.0 through 1.26.1 built with DNS-over-QUIC support (--with-libngtcp2) can be driven to an abnormal exit by an unauthenticated remote attacker who manipulates QUIC stream state. The attacker sends a DoQ query, withholds ACKs, issues RESET_STREAM to free the per-stream output buffer, then waits for a PTO timeout so ngtcp2 re-encodes a STREAM frame from the freed memory; a spray of roughly 20 such queries forces the daemon down. Default builds compiled without QUIC support are not affected, and exploitation also requires precise timing against the QUIC state machine, making this a moderate, configuration-gated availability threat rather than a top-tier priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the authoritative assessment rates it AV:N/AC:H/PR:N/UI:N/S:U with low confidentiality and high availability impact, so the practical outcome is denial of service against the resolver rather than broad data compromise.
Password hash disclosure in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and Phoenix Contact IOL MA8 PN DI8 (plus OEM variants) exposes all user credential hashes to any authenticated low-privileged user. The PHP-based diagnostics endpoint `/index.php/diagnostics_tab/ajax_diag_table_rows` accepts a manipulable `schema` path parameter that, when tampered with using a valid session cookie, causes the server to return the device's full user credential hash store. No public exploit or active exploitation has been identified at time of analysis; three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same underlying vulnerability spans multiple vendor product lines sharing common firmware.
Blind SQL injection in the WP Directory Kit WordPress plugin, affecting all versions up to and including 1.5.4, lets an authenticated attacker with 'custom-level access and above' append arbitrary SQL to an existing query through the unescaped 'order_by' parameter and extract sensitive data from the site's database. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) because exploitation is network-reachable and low-complexity but gated behind a valid low-privilege account; confidentiality is the only impacted pillar, as the injection is blind and does not permit direct read-out or data modification. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated on sites that expose low-privilege accounts and run a vulnerable plugin version.
Keycloak's first broker login flow leaves a temporary account-linking proof behind after a federated identity link is established or manually removed (CWE-613), allowing an attacker who controls the external identity to silently re-establish the link and authenticate as the victim without any further confirmation. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments that use identity brokering, and carries high confidentiality and integrity impact despite a moderate CVSS base of 6.4. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.9.6, lets authenticated users with Contributor-level access plant persistent JavaScript that executes in the browser of anyone who views the injected page. The plugin's bt_bb_save_pre filter is bypassable via null-byte injection, and the bt_bb_raw_content shortcode handler outputs base64-decoded content without adequate sanitization, so payloads survive the intended checks. No public exploit code or CISA KEV entry was identified at time of analysis; the supplied Trac changeset indicates an upstream fix has been committed, but no patched release version is confirmed in the available data.