Total
395687 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-27562 | 2026-09-16 | N/A | 7.2 HIGH | ||
| A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device. | |||||
| CVE-2026-27552 | 2026-09-16 | N/A | 8.1 HIGH | ||
| A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes. | |||||
| CVE-2026-27547 | 2026-09-16 | N/A | 8.8 HIGH | ||
| A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device. | |||||
| CVE-2026-27557 | 2026-09-16 | N/A | 7.5 HIGH | ||
| An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read. | |||||
| CVE-2026-70203 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-16 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-70145 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-16 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-70091 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 4 more | 2026-09-16 | N/A | 5.9 MEDIUM |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to deny service over a network. | |||||
| CVE-2026-21588 | 2026-09-16 | N/A | N/A | ||
| This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.24 Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.17 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Penetration Testing program. | |||||
| CVE-2026-89161 | 1 Pcre | 1 Pcre2 | 2026-09-16 | N/A | 7.4 HIGH |
| In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur. | |||||
| CVE-2026-70019 | 1 Microsoft | 5 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 2 more | 2026-09-16 | N/A | 6.5 MEDIUM |
| Windows hard link in Windows Compressed Folder allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-86107 | 2026-09-16 | N/A | 5.9 MEDIUM | ||
| The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic. | |||||
| CVE-2026-69989 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 4 more | 2026-09-16 | N/A | 8.1 HIGH |
| Use after free in DNS Server allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-73435 | 2026-09-16 | N/A | 8.2 HIGH | ||
| On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain. | |||||
| CVE-2026-2380 | 2026-09-16 | N/A | 7.4 HIGH | ||
| On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability. Examples of sensitive information include: - Sensitive CLI commands (e.g., "username bob secret myPass") - Sensitive OpenConfig YANG leafs (e.g., "system/aaa/global/tacacs/config/secret-key") This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks. | |||||
| CVE-2026-73467 | 2026-09-16 | N/A | 6.3 MEDIUM | ||
| On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers | |||||
| CVE-2026-73445 | 2026-09-16 | N/A | 4.9 MEDIUM | ||
| On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks. | |||||
| CVE-2026-73455 | 2026-09-16 | N/A | 7.5 HIGH | ||
| On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly. | |||||
| CVE-2026-19641 | 2026-09-16 | N/A | 5.3 MEDIUM | ||
| On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks. | |||||
| CVE-2026-73469 | 2026-09-16 | N/A | 5.8 MEDIUM | ||
| When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks. | |||||
| CVE-2026-73468 | 2026-09-16 | N/A | 6.5 MEDIUM | ||
| A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period. | |||||