CVE Notifier

CVE-2026-75944 CWE-459 2.6

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorr…

cve.org Arista · Networks:EOS 14 Sep 2026

CVE-2026-90829 CWE-476 5.3

GNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereference

A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section Handler. Executing a manipulation can lead to null …

cve.org GNU:Binutils 14 Sep 2026

CVE-2026-75943 CWE-459 2.6

A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcem

A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's t…

cve.org Arista · Networks:EOS 14 Sep 2026

CVE-2026-91201 CWE-346 5.4

DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by…

cve.org arc53:DocsGPT 14 Sep 2026

CVE-2026-91200 CWE-22 8.8

DevSpace through 6.3.21 Path Traversal via tar extraction

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitra…

cve.org devspace:devspace 14 Sep 2026

CVE-2026-91199 CWE-918 5.0

Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated atta…

cve.org refly-ai:refly 14 Sep 2026

CVE-2026-91198 CWE-201 5.3

GrowthBook through 5.0.1 Information Disclosure via Public Endpoints

GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared r…

cve.org growthbook:growthbook 14 Sep 2026

CVE-2026-91197 CWE-611 6.5

Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory

Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing deployed BPMN resourc…

cve.org flowable:flowable-engine 14 Sep 2026

CVE-2026-81900 CWE-79 N/A

Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)

Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripti…

cve.org Concrete · CMS:Concrete · CMS 14 Sep 2026

CVE-2026-14986 CWE-787 6.8

Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction

The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data into the fixed-size data->target_in_buffer inside it…

cve.org zephyrproject:zephyr 14 Sep 2026

CVE-2026-77191 CWE-862 2.6

All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access Control Lists (ACLs) configured for per-supplicant policy enforcement. An authenticated supplicant on an

An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of the authenticati…

cve.org Arista · Networks:EOS 14 Sep 2026

CVE-2026-18116 CWE-79 N/A

Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications

Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A re…

cve.org Concrete · CMS:Concrete · CMS 14 Sep 2026