Search
Find a vulnerability
Search criteria
371746 vulnerabilities
CVE-2026-92259 (GCVE-0-2026-92259)
Vulnerability from cvelistv5 – Published: 2026-09-15 21:34 – Updated: 2026-09-15 21:34
VLAI
EPSS
VEX
Summary
Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffer overflow and denial of service via a crafted cache file.
This issue affects Escargot: ac94df78493ee6fede286620d94f724e46b4d238.
Severity
5.5 (Medium)
CWE
- CWE-190 - Integer overflow or wraparound
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Samsung Opensource | Escargot |
Affected:
ac94df78493ee6fede286620d94f724e46b4d238
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Escargot",
"vendor": "Samsung Opensource",
"versions": [
{
"status": "affected",
"version": "ac94df78493ee6fede286620d94f724e46b4d238"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ezinne Kalu"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffer overflow and denial of service via a crafted cache file.\u003cp\u003eThis issue affects Escargot: ac94df78493ee6fede286620d94f724e46b4d238.\u003c/p\u003e"
}
],
"value": "Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffer overflow and denial of service via a crafted cache file.\n\nThis issue affects Escargot: ac94df78493ee6fede286620d94f724e46b4d238."
}
],
"impacts": [
{
"capecId": "CAPEC-92",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-92 Forced Integer Overflow"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer overflow or wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:34:04.487Z",
"orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
"shortName": "samsung.tv_appliance"
},
"references": [
{
"url": "https://github.com/Samsung/escargot/pull/1650"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
"assignerShortName": "samsung.tv_appliance",
"cveId": "CVE-2026-92259",
"datePublished": "2026-09-15T21:34:04.487Z",
"dateReserved": "2026-09-15T21:29:28.195Z",
"dateUpdated": "2026-09-15T21:34:04.487Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92114 (GCVE-0-2026-92114)
Vulnerability from cvelistv5 – Published: 2026-09-15 21:30 – Updated: 2026-09-15 21:30
VLAI
EPSS
VEX
Title
a2ui-project a2ui Basic Catalog safe_regex.ts redos
Summary
A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be launched remotely.
Severity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/404283 | vdb-entry |
| https://vuldb.com/vuln/404283/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-92114 | third-party-advisory |
| https://vuldb.com/submit/934085 | third-party-advisory |
| https://github.com/a2ui-project/a2ui/issues/2292 | issue-tracking |
| https://github.com/a2ui-project/a2ui/pull/2366 | issue-trackingpatch |
| https://github.com/a2ui-project/a2ui/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2ui-project | a2ui |
Affected:
0.10.0
Affected: 0.10.1 Affected: 0.10.2 Affected: 0.10.3 Affected: 0.10.4 Affected: 0.10.5 Affected: 0.10.6 cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Catalog"
],
"product": "a2ui",
"vendor": "a2ui-project",
"versions": [
{
"status": "affected",
"version": "0.10.0"
},
{
"status": "affected",
"version": "0.10.1"
},
{
"status": "affected",
"version": "0.10.2"
},
{
"status": "affected",
"version": "0.10.3"
},
{
"status": "affected",
"version": "0.10.4"
},
{
"status": "affected",
"version": "0.10.5"
},
{
"status": "affected",
"version": "0.10.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be launched remotely."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:30:19.468Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-404283 | a2ui-project a2ui Basic Catalog safe_regex.ts redos",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/404283"
},
{
"name": "VDB-404283 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/404283/cti"
},
{
"name": "CVE-2026-92114 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-92114"
},
{
"name": "Submit #934085 | a2ui-project a2ui 0.10.6 CWE-1333",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/934085"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/a2ui-project/a2ui/issues/2292"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2ui-project/a2ui/pull/2366"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2ui-project/a2ui/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-15T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-15T17:41:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2ui-project a2ui Basic Catalog safe_regex.ts redos",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-92114",
"datePublished": "2026-09-15T21:30:19.468Z",
"dateReserved": "2026-09-15T15:35:54.705Z",
"dateUpdated": "2026-09-15T21:30:19.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73444 (GCVE-0-2026-73444)
Vulnerability from cvelistv5 – Published: 2026-09-15 21:11 – Updated: 2026-09-15 21:11
VLAI
EPSS
VEX
Title
On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the
Summary
On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the attacker to intercept, modify, or discard traffic that hosts on the segment send to the virtual gateway address.
Severity
4.7 (Medium)
CWE
- CWE-303 - Incorrect Implementation of Authentication Algorithm
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.1F
(custom)
Affected: 4.35.0 , ≤ 4.35.5M (custom) Affected: 4.34.0 , ≤ 4.34.7M (custom) Affected: 4.33.0 , ≤ 4.33.9M (custom) Affected: 0 |
Date Public
2026-09-09 21:09
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange",
"virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"changes": [
{
"at": "4.36.2F",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.35.6M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.34.8M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.33.10M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "0"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73444, VRRPv2 must be configured with IP-AH authentication on at least one interface:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show running-config section vrrp\ninterface Ethernet1\n vrrp 1 ipv4 version 2\n vrrp 1 peer authentication ietf-md5 key-string 7 \u0026lt;key\u0026gt;\u003c/pre\u003e\u003cp\u003eIf VRRP is not configured, or is configured as version 3, or is configured without authentication, there is no exposure.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73444, VRRPv2 must be configured with IP-AH authentication on at least one interface:\n\n\n\nswitch\u003eshow running-config section vrrp\ninterface Ethernet1\n vrrp 1 ipv4 version 2\n vrrp 1 peer authentication ietf-md5 key-string 7 \u003ckey\u003e\n\n\n\nIf VRRP is not configured, or is configured as version 3, or is configured without authentication, there is no exposure."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista."
}
],
"datePublic": "2026-09-09T21:09:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the attacker to intercept, modify, or discard traffic that hosts on the segment send to the virtual gateway address.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the attacker to intercept, modify, or discard traffic that hosts on the segment send to the virtual gateway address."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-303",
"description": "CWE-303 Incorrect Implementation of Authentication Algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:11:37.625Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24713-security-advisory-0157"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73444 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73444 has been fixed in the following releases:\n\n * 4.36.2F and later releases in the 4.36.x train\n * 4.35.6M and later releases in the 4.35.x train\n * 4.34.8M and later releases in the 4.34.x train\n * 4.33.10M and later releases in the 4.33.x train"
}
],
"source": {
"advisory": "157",
"defect": [
"1866656"
],
"discovery": "INTERNAL"
},
"title": "On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRestricting physical and logical access to VRRP-enabled segments reduces the attack surface. Additionally, migrating virtual routers from VRRP version 2 with authentication to VRRP version 3 removes the vulnerable code path:\u003c/p\u003e\u003cpre\u003eswitch(config)# interface vlan 20\nswitch(config-if-vl20)# vrrp 1 ipv4 version 3\u003c/pre\u003e"
}
],
"value": "Restricting physical and logical access to VRRP-enabled segments reduces the attack surface. Additionally, migrating virtual routers from VRRP version 2 with authentication to VRRP version 3 removes the vulnerable code path:\n\n\n\nswitch(config)# interface vlan 20\nswitch(config-if-vl20)# vrrp 1 ipv4 version 3"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73444",
"datePublished": "2026-09-15T21:11:37.625Z",
"dateReserved": "2026-08-12T16:39:35.977Z",
"dateUpdated": "2026-09-15T21:11:37.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61560 (GCVE-0-2026-61560)
Vulnerability from cvelistv5 – Published: 2026-09-15 21:09 – Updated: 2026-09-15 21:09
VLAI
EPSS
VEX
Title
@zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
Summary
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read `/proc/self/environ` to steal the server's `GITLAB_PERSONAL_ACCESS_TOKEN` and achieve full GitLab account takeover. This is the default configuration for Docker deployments. Version 2.1.27 contains a patch.
Severity
9.8 (Critical)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/zereight/gitlab-mcp/security/a… | x_refsource_CONFIRM |
| https://github.com/zereight/gitlab-mcp/pull/482 | x_refsource_MISC |
| https://github.com/zereight/gitlab-mcp/pull/554 | x_refsource_MISC |
| https://github.com/zereight/gitlab-mcp/pull/622 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zereight | gitlab-mcp |
Affected:
< 2.1.27
|
{
"containers": {
"cna": {
"affected": [
{
"product": "gitlab-mcp",
"vendor": "zereight",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.27"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server\u0027s local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker can read `/proc/self/environ` to steal the server\u0027s `GITLAB_PERSONAL_ACCESS_TOKEN` and achieve full GitLab account takeover. This is the default configuration for Docker deployments. Version 2.1.27 contains a patch."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:09:00.405Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5"
},
{
"name": "https://github.com/zereight/gitlab-mcp/pull/482",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zereight/gitlab-mcp/pull/482"
},
{
"name": "https://github.com/zereight/gitlab-mcp/pull/554",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zereight/gitlab-mcp/pull/554"
},
{
"name": "https://github.com/zereight/gitlab-mcp/pull/622",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zereight/gitlab-mcp/pull/622"
}
],
"source": {
"advisory": "GHSA-cv3r-c5h8-f4g5",
"discovery": "UNKNOWN"
},
"title": "@zereight/mcp-gitlab\u0027s unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61560",
"datePublished": "2026-09-15T21:09:00.405Z",
"dateReserved": "2026-07-10T16:48:39.923Z",
"dateUpdated": "2026-09-15T21:09:00.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73437 (GCVE-0-2026-73437)
Vulnerability from cvelistv5 – Published: 2026-09-15 21:02 – Updated: 2026-09-15 21:02
VLAI
EPSS
VEX
Title
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat
Summary
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.
Severity
9.6 (Critical)
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.1F
(custom)
Affected: 4.35.0 , ≤ 4.35.5M (custom) Affected: 4.34.0 , ≤ 4.34.7.1M (custom) Affected: 4.33.0 , ≤ 4.33.9M (custom) |
Date Public
2026-09-09 21:02
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange",
"virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"changes": [
{
"at": "4.36.2F",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.35.6M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.34.8M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.34.7.1M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.33.10M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo be vulnerable to CVE-2026-73437, the DHCP relay must be configured, and either an IPv4 or IPv6 helper address must be configured for the DHCP relay to be active.\u003c/p\u003e\u003cp\u003eE.g., Configuring an IPv4 helper address:\u003c/p\u003e\u003cpre\u003eswitch# configure terminal\nswitch(config)#int vlan 100\nswitch(config-if-Vl100)#ip helper-address 10.40.2.3\u003c/pre\u003e\u003cp\u003eE.g., Configuring an IPv6 helper address:\u003c/p\u003e\u003cpre\u003eswitch# configure terminal\nswitch(config)#int vlan 100\nswitch(config-if-Vl100)#ipv6 helper-address 3ffe:701:ffff:100::2\u003c/pre\u003e\u003cp\u003eValidation:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show ip dhcp relay\nDHCP relay is active\n...\nInterface: Vlan100\n DHCPv4 servers: 10.40.2.3\n DHCPv6 servers: 3ffe:701:ffff:100::2\u003c/pre\u003e\u003cp\u003eIf DHCP relay is not active (no helper addresses), there is no exposure to this issue:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show ip dhcp relay\nDHCP relay is not active\u003c/pre\u003e"
}
],
"value": "To be vulnerable to CVE-2026-73437, the DHCP relay must be configured, and either an IPv4 or IPv6 helper address must be configured for the DHCP relay to be active.\n\n\n\nE.g., Configuring an IPv4 helper address:\n\n\n\nswitch# configure terminal\nswitch(config)#int vlan 100\nswitch(config-if-Vl100)#ip helper-address 10.40.2.3\n\n\n\nE.g., Configuring an IPv6 helper address:\n\n\n\nswitch# configure terminal\nswitch(config)#int vlan 100\nswitch(config-if-Vl100)#ipv6 helper-address 3ffe:701:ffff:100::2\n\n\n\nValidation:\n\n\n\nswitch\u003eshow ip dhcp relay\nDHCP relay is active\n...\nInterface: Vlan100\n DHCPv4 servers: 10.40.2.3\n DHCPv6 servers: 3ffe:701:ffff:100::2\n\n\n\nIf DHCP relay is not active (no helper addresses), there is no exposure to this issue:\n\n\n\nswitch\u003eshow ip dhcp relay\nDHCP relay is not active"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista."
}
],
"datePublic": "2026-09-09T21:02:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients."
}
],
"impacts": [
{
"capecId": "CAPEC-68",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-68 IP Address Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:02:49.314Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24712-security-advisory-0156"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience and enable the reply source-address validation CLI knob under dhcp relay mode:\u003c/p\u003e\u003cpre\u003eswitch(config)# dhcp relay\nswitch(config-dhcp-relay)# reply source-address validation\u003c/pre\u003e\u003cp\u003eCVE-2026-73437 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e All versions require upgrading to a release containing the fix (as listed above) and applying the required configuration. Arista will not be providing any hotfixes.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience and enable the reply source-address validation CLI knob under dhcp relay mode:\n\n\n\nswitch(config)# dhcp relay\nswitch(config-dhcp-relay)# reply source-address validation\n\n\n\nCVE-2026-73437 has been fixed in the following releases:\n\n * 4.36.2F and later releases in the 4.36.x train\n * 4.35.6M and later releases in the 4.35.x train\n * 4.34.8M and later releases in the 4.34.x train\n * 4.33.10M and later releases in the 4.33.x train\n\n\n\n\nNote: All versions require upgrading to a release containing the fix (as listed above) and applying the required configuration. Arista will not be providing any hotfixes."
}
],
"source": {
"advisory": "156",
"defect": [
"1869660"
],
"discovery": "INTERNAL"
},
"title": "On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIP locking can be run in a locked address enforcement disabled state, along with the DHCP Relay, to provide protection against rogue DHCP servers and spoofing. This is supported on DHCPv4 starting with EOS-4.29.0F and on DHCPv6 starting with EOS-4.27.0F. For more information, see \u003ca href=\"https://www.arista.com/en/support/toi/eos-4-25-1f/14628-ip-locking-release-updates\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eIP Locking\u003c/a\u003e.\u003c/p\u003e\u003cdiv\u003eThis is compatible with the following platforms only:\u003c/div\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cul\u003e\u003cli\u003eCCS-720XP\u003c/li\u003e\u003cli\u003eCCS-710P\u003c/li\u003e\u003cli\u003eCCS-720DP\u003c/li\u003e\u003cli\u003eCCS-722XPM\u003c/li\u003e\u003cli\u003eDCS-7010TX\u003c/li\u003e\u003cli\u003eDCS-7050CX3\u003c/li\u003e\u003cli\u003eDCS-7050SX3\u003c/li\u003e\u003cli\u003eCCS-710XP\u003c/li\u003e\u003cli\u003eCCS-720DF\u003c/li\u003e\u003cli\u003eCCS-720DT\u003c/li\u003e\u003cli\u003eCCS-720XDM\u003c/li\u003e\u003cli\u003eCCS-720XPM\u003c/li\u003e\u003cli\u003eCCS-755\u003c/li\u003e\u003cli\u003eCCS-758\u003c/li\u003e\u003cli\u003eDCS-7050CX3M\u003c/li\u003e\u003cli\u003eDCS-7050TX3\u003c/li\u003e\u003cli\u003eDCS-7304\u003c/li\u003e\u003cli\u003eDCS-7308\u003c/li\u003e\u003cli\u003e7300X3\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eUntrusted ports can be locked with the following configuration:\u003c/p\u003e\u003cpre\u003eswitch(config)# address locking\nswitch(config-address-locking)# locked-address ipv4 enforcement disabled\nswitch(config-address-locking)# locked-address ipv6 enforcement disabled\n \nswitch(config)# int et 5\nswitch(config-if-Et5)# address locking ?\n\u0026nbsp;\u0026nbsp;ipv4\u0026nbsp; Enable address locking for IPv4\n\u0026nbsp;\u0026nbsp;ipv6\u0026nbsp; Enable address locking for IPv6\n\u0026nbsp;\u0026nbsp;\u0026lt;cr\u0026gt;\nswitch(config-if-Et5)# address locking ipv4\nswitch(config-if-Et5)# address locking ipv6\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eThe above configuration can be validated using the following output:\u003c/p\u003e\u003cpre\u003eswitch# show address locking\nIP Locking is active\nLogging events: None\nBindings persistence is enabled\nBindings last backup time: Not Available\nConfigured IPv4 Interfaces: \u0026nbsp; \u0026nbsp; \u0026nbsp; Et5\nConfigured IPv6 Interfaces: \u0026nbsp; \u0026nbsp; \u0026nbsp; Et5\nConfigured IPv4 VLANs:\nConfigured IPv6 VLANs:\n \nInterface Status\nInterface\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; IPv4 \u0026nbsp; \u0026nbsp; \u0026nbsp; IPv6\n---------------- ---------- -------------------\nEthernet5\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; yes* \u0026nbsp; \u0026nbsp; \u0026nbsp; yes*\n \n* Locked address enforcement is disabled\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eWith the above configuration applied, DHCP traffic from untrusted ports can be blocked and the following output reflects the packet drops:\u003c/p\u003e\u003cpre\u003eswitch#show address locking counters detail\nAction\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Count\n--------------------------------- -----\nARP (0.0.0.0) PERMIT\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0\nDHCP from client to server PERMIT \u0026nbsp; \u0026nbsp; 0\nDHCP from server DROP \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 4\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eIn releases prior to EOS-4.35.0F, \u201c\u003cb\u003eshow address locking counters detail\u003c/b\u003e\u201d command is not available. Instead, run \u201c\u003cb\u003eshow platform trident tcam detail\u003c/b\u003e\u201d and grep for these IP Locking counters.\u003c/p\u003e\u003cpre\u003eswitch#show platform trident tcam detail\n=== TCAM detail for switch Linecard0/0 ===\nGroups programmed in IFP\n...\nTCAM group 129 copy 0 in PIPE 0 uses 3 entries and can use up to 12282 more.\n\u0026nbsp;\u0026nbsp;IP Locking v4 uses 3 entries.\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x0000005c\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - Unknown ARP permit rule\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x0000005d\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - DHCP permit from client\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x00000060\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 4 hits - DHCP drop from server\nTCAM group 129 copy 1 in PIPE 0 uses 3 entries and can use up to 12282 more.\n\u0026nbsp;\u0026nbsp;IP Locking v4 uses 3 entries.\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x0800005c\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - Unknown ARP permit rule\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x0800005d\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - DHCP permit from client\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x08000060\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - DHCP drop from server\u003c/pre\u003e"
}
],
"value": "IP locking can be run in a locked address enforcement disabled state, along with the DHCP Relay, to provide protection against rogue DHCP servers and spoofing. This is supported on DHCPv4 starting with EOS-4.29.0F and on DHCPv6 starting with EOS-4.27.0F. For more information, see IP Locking https://www.arista.com/en/support/toi/eos-4-25-1f/14628-ip-locking-release-updates .\n\nThis is compatible with the following platforms only:\n\n\u00a0\n\n * CCS-720XP\n * CCS-710P\n * CCS-720DP\n * CCS-722XPM\n * DCS-7010TX\n * DCS-7050CX3\n * DCS-7050SX3\n * CCS-710XP\n * CCS-720DF\n * CCS-720DT\n * CCS-720XDM\n * CCS-720XPM\n * CCS-755\n * CCS-758\n * DCS-7050CX3M\n * DCS-7050TX3\n * DCS-7304\n * DCS-7308\n * 7300X3\n\n\n\n\nUntrusted ports can be locked with the following configuration:\n\n\n\nswitch(config)# address locking\nswitch(config-address-locking)# locked-address ipv4 enforcement disabled\nswitch(config-address-locking)# locked-address ipv6 enforcement disabled\n \nswitch(config)# int et 5\nswitch(config-if-Et5)# address locking ?\n\u00a0\u00a0ipv4\u00a0 Enable address locking for IPv4\n\u00a0\u00a0ipv6\u00a0 Enable address locking for IPv6\n\u00a0\u00a0\u003ccr\u003e\nswitch(config-if-Et5)# address locking ipv4\nswitch(config-if-Et5)# address locking ipv6\n\n\n\u00a0\n\n\n\nThe above configuration can be validated using the following output:\n\n\n\nswitch# show address locking\nIP Locking is active\nLogging events: None\nBindings persistence is enabled\nBindings last backup time: Not Available\nConfigured IPv4 Interfaces: \u00a0 \u00a0 \u00a0 Et5\nConfigured IPv6 Interfaces: \u00a0 \u00a0 \u00a0 Et5\nConfigured IPv4 VLANs:\nConfigured IPv6 VLANs:\n \nInterface Status\nInterface\u00a0 \u00a0 \u00a0 \u00a0 IPv4 \u00a0 \u00a0 \u00a0 IPv6\n---------------- ---------- -------------------\nEthernet5\u00a0 \u00a0 \u00a0 \u00a0 yes* \u00a0 \u00a0 \u00a0 yes*\n \n* Locked address enforcement is disabled\n\n\n\u00a0\n\n\n\nWith the above configuration applied, DHCP traffic from untrusted ports can be blocked and the following output reflects the packet drops:\n\n\n\nswitch#show address locking counters detail\nAction\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Count\n--------------------------------- -----\nARP (0.0.0.0) PERMIT\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\nDHCP from client to server PERMIT \u00a0 \u00a0 0\nDHCP from server DROP \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4\n\n\n\u00a0\n\n\n\nIn releases prior to EOS-4.35.0F, \u201cshow address locking counters detail\u201d command is not available. Instead, run \u201cshow platform trident tcam detail\u201d and grep for these IP Locking counters.\n\n\n\nswitch#show platform trident tcam detail\n=== TCAM detail for switch Linecard0/0 ===\nGroups programmed in IFP\n...\nTCAM group 129 copy 0 in PIPE 0 uses 3 entries and can use up to 12282 more.\n\u00a0\u00a0IP Locking v4 uses 3 entries.\n\u00a0\u00a0\u00a0\u00a00x0000005c\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - Unknown ARP permit rule\n\u00a0\u00a0\u00a0\u00a00x0000005d\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - DHCP permit from client\n\u00a0\u00a0\u00a0\u00a00x00000060\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4 hits - DHCP drop from server\nTCAM group 129 copy 1 in PIPE 0 uses 3 entries and can use up to 12282 more.\n\u00a0\u00a0IP Locking v4 uses 3 entries.\n\u00a0\u00a0\u00a0\u00a00x0800005c\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - Unknown ARP permit rule\n\u00a0\u00a0\u00a0\u00a00x0800005d\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - DHCP permit from client\n\u00a0\u00a0\u00a0\u00a00x08000060\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - DHCP drop from server"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73437",
"datePublished": "2026-09-15T21:02:49.314Z",
"dateReserved": "2026-08-12T16:39:35.976Z",
"dateUpdated": "2026-09-15T21:02:49.314Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10144 (GCVE-0-2026-10144)
Vulnerability from cvelistv5 – Published: 2026-09-15 21:01 – Updated: 2026-09-15 21:01 X_Open Source
VLAI
EPSS
VEX
Title
Rsbuild < 2.0.9 Command Injection via openBrowser() URL Handling
Summary
Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser() function in packages/core/src/server/open.ts passes the URL through encodeURI() before interpolating it into a shell command executed via child_process.exec(), but because encodeURI() does not encode dollar signs, parentheses, or semicolons, embedded shell metacharacters are evaluated by /bin/sh, enabling arbitrary command execution.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/web-infra-dev/rsbuild/releases… | release-notes |
| https://github.com/web-infra-dev/rsbuild/pull/7789 | issue-tracking |
| https://github.com/web-infra-dev/rsbuild/commit/c… | patch |
| https://www.vulncheck.com/advisories/rsbuild-comm… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| web-infra-dev | rsbuild |
Affected:
0 , < 2.0.9
(semver)
|
Date Public
2026-05-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/web-infra-dev/rsbuild",
"product": "rsbuild",
"repo": "https://github.com/web-infra-dev/rsbuild",
"vendor": "web-infra-dev",
"versions": [
{
"lessThan": "2.0.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Katriel Moses"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"datePublic": "2026-05-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser() function in packages/core/src/server/open.ts passes the URL through encodeURI() before interpolating it into a shell command executed via child_process.exec(), but because encodeURI() does not encode dollar signs, parentheses, or semicolons, embedded shell metacharacters are evaluated by /bin/sh, enabling arbitrary command execution."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:01:07.742Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/web-infra-dev/rsbuild/releases/tag/v2.0.9"
},
{
"name": "Pull Request",
"tags": [
"issue-tracking"
],
"url": "https://github.com/web-infra-dev/rsbuild/pull/7789"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/web-infra-dev/rsbuild/commit/c1e2aebd6b1bbdaece15265572c3284f934b674d"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/rsbuild-command-injection-via-openbrowser-url-handling"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Rsbuild \u003c 2.0.9 Command Injection via openBrowser() URL Handling",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-10144",
"datePublished": "2026-09-15T21:01:07.742Z",
"dateReserved": "2026-05-29T22:17:43.223Z",
"dateUpdated": "2026-09-15T21:01:07.742Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68491 (GCVE-0-2026-68491)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:59 – Updated: 2026-09-15 20:59
VLAI
EPSS
VEX
Summary
An insufficient check allowed for the overwrite of arbitrary files via a symlink.
Severity
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SolusVM",
"vendor": "Webpros",
"versions": [
{
"lessThan": "1.30.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RackNerd"
}
],
"descriptions": [
{
"lang": "en",
"value": "An insufficient check allowed for the overwrite of arbitrary files via a symlink."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:59:50.186Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://docs.solusvm.com/en/solusvm1/release-notes/stable-branch/v1.30/#13015"
},
{
"url": "https://docs.solusvm.com/en/solusvm1/release-notes/mainline-branch/v1.30/#13015"
},
{
"url": "https://support.solusvm.com/hc/en-us/articles/43503583489687-CVE-2026-68491-Vulnerability-in-SolusVM-1-allows-Guest-to-Host-privilege-escalation"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-68491",
"datePublished": "2026-09-15T20:59:50.186Z",
"dateReserved": "2026-07-30T15:00:00.609Z",
"dateUpdated": "2026-09-15T20:59:50.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61559 (GCVE-0-2026-61559)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:58 – Updated: 2026-09-15 20:58
VLAI
EPSS
VEX
Title
@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
Summary
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server reads the `X-GitLab-API-URL` HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (`new URL(dynamicApiUrl)`) but applies no allowlist or hostname restriction. The server then attaches the victim's `Private-Token` to every outbound fetch that uses the redirected URL. Any caller who can reach the HTTP transport can set `X-GitLab-API-URL` to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host. Version 2.1.27 contains a patch.
Severity
9.6 (Critical)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/zereight/gitlab-mcp/security/a… | x_refsource_CONFIRM |
| https://github.com/zereight/gitlab-mcp/pull/625 | x_refsource_MISC |
| https://github.com/zereight/gitlab-mcp/commit/6ff… | x_refsource_MISC |
| https://github.com/zereight/gitlab-mcp/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zereight | gitlab-mcp |
Affected:
>= 0.0.1, < 2.1.27
|
{
"containers": {
"cna": {
"affected": [
{
"product": "gitlab-mcp",
"vendor": "zereight",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.0.1, \u003c 2.1.27"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server reads the `X-GitLab-API-URL` HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (`new URL(dynamicApiUrl)`) but applies no allowlist or hostname restriction. The server then attaches the victim\u0027s `Private-Token` to every outbound fetch that uses the redirected URL. Any caller who can reach the HTTP transport can set `X-GitLab-API-URL` to an attacker-controlled host. The next GitLab API call the server makes delivers the victim\u0027s token to that host. Version 2.1.27 contains a patch."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:58:41.639Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj"
},
{
"name": "https://github.com/zereight/gitlab-mcp/pull/625",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zereight/gitlab-mcp/pull/625"
},
{
"name": "https://github.com/zereight/gitlab-mcp/commit/6ffb4cc70706fd05b1ab80901676bc2998b6db6d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zereight/gitlab-mcp/commit/6ffb4cc70706fd05b1ab80901676bc2998b6db6d"
},
{
"name": "https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.27",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.27"
}
],
"source": {
"advisory": "GHSA-2h44-8472-frjj",
"discovery": "UNKNOWN"
},
"title": "@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61559",
"datePublished": "2026-09-15T20:58:41.639Z",
"dateReserved": "2026-07-10T16:48:39.923Z",
"dateUpdated": "2026-09-15T20:58:41.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19655 (GCVE-0-2026-19655)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:56 – Updated: 2026-09-15 20:56
VLAI
EPSS
VEX
Title
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthent
Summary
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthenticated attacker connected to a client-facing VLAN(s) where the relay is configured can send a specially crafted packet that causes the DHCP Relay service to restart.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.35.0 , ≤ 4.35.5M
(custom)
Affected: 4.34.0 , ≤ 4.34.7.1M (custom) Affected: 4.33.0 , ≤ 4.33.9M (custom) |
Date Public
2026-09-09 20:56
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange",
"virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"changes": [
{
"at": "4.35.6M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.34.8M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.34.7.1M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.33.10M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-19655, any of the following conditions must be met:\u003c/p\u003e\u003cp\u003e1. Configure \"ip dhcp relay\" with the \"information option\" (Option 82) and at least one helper-address on an interface:\u003c/p\u003e\u003cpre\u003einterface Vlan100\n ip helper-address 1.1.1.2\n ip dhcp relay information option\u003c/pre\u003e\u003cp\u003e2. Configure \"ip dhcp snooping\" with the \"information option\":\u003c/p\u003e\u003cpre\u003eswitch#show running-config | grep snooping\nip dhcp snooping\nip dhcp snooping information option\nip dhcp snooping vlan 100\u003c/pre\u003e\u003cp\u003e3. The DHCP server uses match criteria based on the information option, configured with \"information option arista-switch\" commands:\u003c/p\u003e\u003cpre\u003edhcp server\n client class ipv4 definition name\n assignments\n private-option 224 always-send type string data \"data1\"\n !\n match\n information option arista-switch Ethernet55/1 vlan 100\n !\n subnet 1.0.0.0/24\n range 1.0.0.1 1.0.0.5\ninterface Vlan10\n dhcp server ipv4\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-19655, any of the following conditions must be met:\n\n\n\n1. Configure \"ip dhcp relay\" with the \"information option\" (Option 82) and at least one helper-address on an interface:\n\n\n\ninterface Vlan100\n ip helper-address 1.1.1.2\n ip dhcp relay information option\n\n\n\n2. Configure \"ip dhcp snooping\" with the \"information option\":\n\n\n\nswitch#show running-config | grep snooping\nip dhcp snooping\nip dhcp snooping information option\nip dhcp snooping vlan 100\n\n\n\n3. The DHCP server uses match criteria based on the information option, configured with \"information option arista-switch\" commands:\n\n\n\ndhcp server\n client class ipv4 definition name\n assignments\n private-option 224 always-send type string data \"data1\"\n !\n match\n information option arista-switch Ethernet55/1 vlan 100\n !\n subnet 1.0.0.0/24\n range 1.0.0.1 1.0.0.5\ninterface Vlan10\n dhcp server ipv4"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista."
}
],
"datePublic": "2026-09-09T20:56:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthenticated attacker connected to a client-facing VLAN(s) where the relay is configured can send a specially crafted packet that causes the DHCP Relay service to restart.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthenticated attacker connected to a client-facing VLAN(s) where the relay is configured can send a specially crafted packet that causes the DHCP Relay service to restart."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:56:46.678Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24711-security-advisory-0155"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-19655 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-19655 has been fixed in the following releases:\n\n * 4.35.6M and later releases in the 4.35.x train\n * 4.34.8M and later releases in the 4.34.x train\n * 4.33.10M and later releases in the 4.33.x train"
}
],
"source": {
"advisory": "155",
"defect": [
"1770194"
],
"discovery": "INTERNAL"
},
"title": "On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthent",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no workaround known for this issue.\u003c/p\u003e"
}
],
"value": "There is no workaround known for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-19655",
"datePublished": "2026-09-15T20:56:46.678Z",
"dateReserved": "2026-08-12T18:51:29.572Z",
"dateUpdated": "2026-09-15T20:56:46.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92234 (GCVE-0-2026-92234)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:56 – Updated: 2026-09-15 20:56
VLAI
EPSS
VEX
Title
QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors
Summary
QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Qloapps/QloApps/pull/1796 | patchissue-tracking |
| https://github.com/Qloapps/QloApps/commit/54a3b30… | patch |
| https://github.com/Qloapps/QloApps/blob/v1.7.0/mo… | technical-description |
| https://hackmd.io/@leediay/r1aoFrMFGl | technical-description |
| https://github.com/Qloapps/QloApps | product |
| https://www.vulncheck.com/advisories/qloapps-thro… | third-party-advisory |
Impacted products
Date Public
2026-08-07 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Qloapps/QloApps",
"product": "QloApps",
"programFiles": [
"modules/hotelreservationsystem/controllers/admin/AdminHotelfeaturesController.php"
],
"repo": "https://github.com/Qloapps/QloApps",
"vendor": "Webkul",
"versions": [
{
"lessThanOrEqual": "1.7.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:webkul:qloapps:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "leediay153"
}
],
"datePublic": "2026-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:56:46.515Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Fix PR #1796",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Qloapps/QloApps/pull/1796"
},
{
"name": "Merge commit",
"tags": [
"patch"
],
"url": "https://github.com/Qloapps/QloApps/commit/54a3b30e4e5c2d6b224dc8fe55e75db173064b91"
},
{
"name": "Unescaped error paths at v1.7.0",
"tags": [
"technical-description"
],
"url": "https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/controllers/admin/AdminHotelfeaturesController.php"
},
{
"name": "Reporter write-up",
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@leediay/r1aoFrMFGl"
},
{
"tags": [
"product"
],
"url": "https://github.com/Qloapps/QloApps"
},
{
"name": "VulnCheck Advisory: QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-hotel-feature-validation-errors"
}
],
"title": "QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92234",
"datePublished": "2026-09-15T20:56:46.515Z",
"dateReserved": "2026-09-15T19:27:24.634Z",
"dateUpdated": "2026-09-15T20:56:46.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92000 (GCVE-0-2026-92000)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:56 – Updated: 2026-09-15 20:56
VLAI
EPSS
VEX
Title
adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size
Summary
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.
Severity
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/cthackers/adm-zip/security/adv… | vendor-advisory |
| https://github.com/cthackers/adm-zip/commit/49160… | patch |
| https://github.com/cthackers/adm-zip/commit/8bc41… | technical-descriptionpatch |
| https://github.com/cthackers/adm-zip/blob/v0.6.0/… | technical-description |
| https://github.com/cthackers/adm-zip | product |
| https://www.vulncheck.com/advisories/adm-zip-0.5.… | third-party-advisory |
Impacted products
Date Public
2026-09-11 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/adm-zip",
"defaultStatus": "unaffected",
"packageName": "adm-zip",
"packageURL": "pkg:npm/adm-zip",
"product": "adm-zip",
"programFiles": [
"methods/inflater.js"
],
"repo": "https://github.com/cthackers/adm-zip",
"vendor": "cthackers",
"versions": [
{
"lessThan": "0.6.1",
"status": "affected",
"version": "0.5.14",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adm-zip_project:adm-zip:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.6.1",
"versionStartIncluding": "0.5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dilipkumar Choudhary"
}
],
"datePublic": "2026-09-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:56:45.780Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rcw4-f5rp-g42v)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v"
},
{
"name": "Fix commit (0.6.1)",
"tags": [
"patch"
],
"url": "https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6"
},
{
"name": "Commit introducing the conditional cap (0.5.14)",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/cthackers/adm-zip/commit/8bc411184de1b5ca28138c53074fb61119994dde"
},
{
"name": "Vulnerable inflater.js at v0.6.0",
"tags": [
"technical-description"
],
"url": "https://github.com/cthackers/adm-zip/blob/v0.6.0/methods/inflater.js"
},
{
"tags": [
"product"
],
"url": "https://github.com/cthackers/adm-zip"
},
{
"name": "VulnCheck Advisory: adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/adm-zip-0.5.14-through-0.6.0-denial-of-service-via-zero-declared-uncompressed-size"
}
],
"title": "adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92000",
"datePublished": "2026-09-15T20:56:45.780Z",
"dateReserved": "2026-09-15T11:12:09.501Z",
"dateUpdated": "2026-09-15T20:56:45.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91939 (GCVE-0-2026-91939)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:56 – Updated: 2026-09-15 20:56
VLAI
EPSS
VEX
Title
Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter
Summary
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
Severity
9.8 (Critical)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1888 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1889 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-1.0.… | third-party-advisory |
Impacted products
Date Public
2026-09-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"plugins/comments/inc/CommentsWidget.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:56:45.058Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1888",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1888"
},
{
"name": "Proposed fix PR #1889 (unmerged)",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1889"
},
{
"name": "CommentsWidget::run() at 1.0.0",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/inc/CommentsWidget.php"
},
{
"name": "AJAX display controller at 1.0.0",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/controllers/actions/DisplayAction.php"
},
{
"name": "Default comments permissions at 1.0.0",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/comments.setup.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-1.0.0-comments-plugin-php-object-injection-via-ci-parameter"
}
],
"title": "Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91939",
"datePublished": "2026-09-15T20:56:45.058Z",
"dateReserved": "2026-09-15T11:07:01.912Z",
"dateUpdated": "2026-09-15T20:56:45.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61568 (GCVE-0-2026-61568)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:56 – Updated: 2026-09-15 20:56
VLAI
EPSS
VEX
Title
@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
Summary
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled `Host` and `Origin`. The server accepts those headers and reaches the MCP initialization path instead of rejecting the request at the HTTP boundary. Version 2.1.30 contains a patch.
Severity
9.6 (Critical)
CWE
- CWE-350 - Reliance on Reverse DNS Resolution for a Security-Critical Action
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/zereight/gitlab-mcp/security/a… | x_refsource_CONFIRM |
| https://github.com/zereight/gitlab-mcp/pull/555 | x_refsource_MISC |
| https://github.com/zereight/gitlab-mcp/commit/522… | x_refsource_MISC |
| https://github.com/zereight/gitlab-mcp/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zereight | gitlab-mcp |
Affected:
< 2.1.30
|
{
"containers": {
"cna": {
"affected": [
{
"product": "gitlab-mcp",
"vendor": "zereight",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.30"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim\u0027s local MCP listener while preserving an attacker-controlled `Host` and `Origin`. The server accepts those headers and reaches the MCP initialization path instead of rejecting the request at the HTTP boundary. Version 2.1.30 contains a patch."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-350",
"description": "CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:56:11.723Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-vmp7-252j-cwp7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-vmp7-252j-cwp7"
},
{
"name": "https://github.com/zereight/gitlab-mcp/pull/555",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zereight/gitlab-mcp/pull/555"
},
{
"name": "https://github.com/zereight/gitlab-mcp/commit/52207c6f5c0e7a39e9235d491225edbb562a0290",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zereight/gitlab-mcp/commit/52207c6f5c0e7a39e9235d491225edbb562a0290"
},
{
"name": "https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.30",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.30"
}
],
"source": {
"advisory": "GHSA-vmp7-252j-cwp7",
"discovery": "UNKNOWN"
},
"title": "@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61568",
"datePublished": "2026-09-15T20:56:11.723Z",
"dateReserved": "2026-07-10T16:48:39.924Z",
"dateUpdated": "2026-09-15T20:56:11.723Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61554 (GCVE-0-2026-61554)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:48 – Updated: 2026-09-15 20:48
VLAI
EPSS
VEX
Title
emp3r0r has an unauthenticated HTTP Polling DoS
Summary
emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue.
Severity
7.5 (High)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/jm33-m0/emp3r0r/security/advis… | x_refsource_CONFIRM |
| https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "emp3r0r",
"vendor": "jm33-m0",
"versions": [
{
"status": "affected",
"version": "\u003c 4.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:48:05.156Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34"
},
{
"name": "https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jm33-m0/emp3r0r/releases/tag/v4.2.5"
}
],
"source": {
"advisory": "GHSA-4595-rvpx-4q34",
"discovery": "UNKNOWN"
},
"title": "emp3r0r has an unauthenticated HTTP Polling DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61554",
"datePublished": "2026-09-15T20:48:05.156Z",
"dateReserved": "2026-07-10T16:48:39.923Z",
"dateUpdated": "2026-09-15T20:48:05.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91719 (GCVE-0-2026-91719)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Severity
No CVSS data available.
CWE
- CWE-94 - Code injection
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code injection",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:36.469Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/542115030"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91719",
"datePublished": "2026-09-15T20:41:36.469Z",
"dateReserved": "2026-09-14T22:51:39.851Z",
"dateUpdated": "2026-09-15T20:41:36.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91722 (GCVE-0-2026-91722)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Severity
No CVSS data available.
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:36.272Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/554953456"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91722",
"datePublished": "2026-09-15T20:41:36.272Z",
"dateReserved": "2026-09-14T22:51:52.475Z",
"dateUpdated": "2026-09-15T20:41:36.272Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91730 (GCVE-0-2026-91730)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Severity
No CVSS data available.
CWE
- CWE-459 - Incomplete cleanup
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-459",
"description": "Incomplete cleanup",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:36.048Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/543640868"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91730",
"datePublished": "2026-09-15T20:41:36.048Z",
"dateReserved": "2026-09-14T22:52:20.778Z",
"dateUpdated": "2026-09-15T20:41:36.048Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91738 (GCVE-0-2026-91738)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Severity
No CVSS data available.
CWE
- CWE-20 - Improper input validation
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper input validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:35.801Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/536450979"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91738",
"datePublished": "2026-09-15T20:41:35.801Z",
"dateReserved": "2026-09-14T22:52:43.103Z",
"dateUpdated": "2026-09-15T20:41:35.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91713 (GCVE-0-2026-91713)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Severity
No CVSS data available.
CWE
- CWE-862 - Missing authorization
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:35.572Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/523715133"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91713",
"datePublished": "2026-09-15T20:41:35.572Z",
"dateReserved": "2026-09-14T22:51:11.916Z",
"dateUpdated": "2026-09-15T20:41:35.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91739 (GCVE-0-2026-91739)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Severity
No CVSS data available.
CWE
- CWE-862 - Missing authorization
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:35.335Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/521951328"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91739",
"datePublished": "2026-09-15T20:41:35.335Z",
"dateReserved": "2026-09-14T22:52:49.755Z",
"dateUpdated": "2026-09-15T20:41:35.335Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91725 (GCVE-0-2026-91725)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Severity
No CVSS data available.
CWE
- CWE-203 - Observable discrepancy
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-203",
"description": "Observable discrepancy",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:35.089Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/518032534"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91725",
"datePublished": "2026-09-15T20:41:35.089Z",
"dateReserved": "2026-09-14T22:52:01.641Z",
"dateUpdated": "2026-09-15T20:41:35.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91714 (GCVE-0-2026-91714)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Severity
No CVSS data available.
CWE
- CWE-203 - Observable discrepancy
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-203",
"description": "Observable discrepancy",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:34.850Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/517710554"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91714",
"datePublished": "2026-09-15T20:41:34.850Z",
"dateReserved": "2026-09-14T22:51:13.081Z",
"dateUpdated": "2026-09-15T20:41:34.850Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91742 (GCVE-0-2026-91742)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)
Severity
No CVSS data available.
CWE
- CWE-441 - Confused deputy
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "Confused deputy",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:34.646Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/513858387"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91742",
"datePublished": "2026-09-15T20:41:34.646Z",
"dateReserved": "2026-09-14T22:52:56.813Z",
"dateUpdated": "2026-09-15T20:41:34.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91732 (GCVE-0-2026-91732)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Severity
No CVSS data available.
CWE
- CWE-862 - Missing authorization
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:34.465Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/511062248"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91732",
"datePublished": "2026-09-15T20:41:34.465Z",
"dateReserved": "2026-09-14T22:52:22.940Z",
"dateUpdated": "2026-09-15T20:41:34.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91723 (GCVE-0-2026-91723)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Severity
No CVSS data available.
CWE
- CWE-362 - Race condition
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race condition",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:34.190Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/474131239"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91723",
"datePublished": "2026-09-15T20:41:34.190Z",
"dateReserved": "2026-09-14T22:51:58.909Z",
"dateUpdated": "2026-09-15T20:41:34.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91745 (GCVE-0-2026-91745)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
No CVSS data available.
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:33.958Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/558734727"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91745",
"datePublished": "2026-09-15T20:41:33.958Z",
"dateReserved": "2026-09-14T22:53:00.190Z",
"dateUpdated": "2026-09-15T20:41:33.958Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91715 (GCVE-0-2026-91715)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
No CVSS data available.
CWE
- CWE-843 - Type confusion
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Type confusion",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:33.733Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/558367547"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91715",
"datePublished": "2026-09-15T20:41:33.733Z",
"dateReserved": "2026-09-14T22:51:20.797Z",
"dateUpdated": "2026-09-15T20:41:33.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91711 (GCVE-0-2026-91711)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
No CVSS data available.
CWE
- CWE-787 - Out of bounds write
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out of bounds write",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:33.539Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/558342353"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91711",
"datePublished": "2026-09-15T20:41:33.539Z",
"dateReserved": "2026-09-14T22:51:08.914Z",
"dateUpdated": "2026-09-15T20:41:33.539Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91737 (GCVE-0-2026-91737)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
No CVSS data available.
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:33.308Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/558036280"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91737",
"datePublished": "2026-09-15T20:41:33.308Z",
"dateReserved": "2026-09-14T22:52:38.077Z",
"dateUpdated": "2026-09-15T20:41:33.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91729 (GCVE-0-2026-91729)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:41 – Updated: 2026-09-15 20:41
VLAI
EPSS
VEX
Summary
Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
No CVSS data available.
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.47",
"status": "affected",
"version": "153.0.8010.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:41:33.103Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"url": "https://issues.chromium.org/issues/557206809"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-91729",
"datePublished": "2026-09-15T20:41:33.103Z",
"dateReserved": "2026-09-14T22:52:11.697Z",
"dateUpdated": "2026-09-15T20:41:33.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}