CWE-459 vulnerabilities

CVE-2026-75944 is a low-severity vulnerability in Arista Networks EOS where a race condition during supplicant re-authentication can cause a stale ACL entry to persist. If the AclAgent service is restarted by an administrator, this stale ACL entry may be applied incorrectly to new supplicants, leading to improper access control enforcement. This issue requires manual intervention (an AclAgent restart) to manifest.

A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement.

Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.

CVE-2026-77761 is a parser state isolation vulnerability in the misp-stix component of MISP. It causes data from a previously processed STIX document to be retained and mixed into subsequent MISP events when the same parser instance is reused. This affects STIX 1 and STIX 2 parsers, leading to incorrect associations and potential limited information disclosure between events. The vulnerability requires reuse of parser instances and specific document ordering, increasing exploitation complexity. There is no impact on availability or code execution.

CVE-2026-67442 is an improper access control vulnerability in frangoteam's FUXA web-based Process Visualization software. Versions prior to 1.3.3 have an issue where deleting a role does not fully remove the role identifier from users' role arrays or runtime caches. This can cause users to retain permissions that administrators intended to revoke, leading to residual privileges and inconsistent access control states. The issue is fixed in version 1.3.3.

A vulnerability in ZcashFoundation's Zebra node prior to version 4.5.0 allows a remote unauthenticated peer to stall the node by exploiting incomplete cleanup of invalid block bodies. This occurs due to a race condition where an invalid block body is cached and suppresses the processing of the valid canonical block body, causing the node to lag one block height until restart or reorganization. The issue is fixed in version 4.5.0.

Zebra, a Zcash node implementation in Rust, had an incomplete cleanup vulnerability prior to version 4.5.0. This flaw allowed stale subtree roots from reverted chain forks to persist in the node's state and be written to persistent storage. As a result, wallet clients relying on this data could experience synchronization failures or incorrect wallet states, necessitating a full state rebuild. The issue is resolved in Zebra version 4.5.0.

CVE-2026-19730 is a vulnerability in Red Hat Enterprise Linux 10 related to the 'podman quadlet install --replace' command. The command fails to truncate the destination file when replacing it, leading to leftover content from the original file if the new file is smaller. This can cause security-sensitive options from the old Quadlet to persist unintentionally, potentially resulting in undesirable behavior such as unauthorized capabilities or mounts being retained in containers. There is no risk of information leakage since the user must already have access to the Quadlet. The issue arises from the use of file open flags without O_TRUNC and a non-truncating fallback copy method.

Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete cleanup of an internal driver state, allowing for future unauthorized access to the contents of the physical memory.

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.

AutoGPT versions 0.4.2 through 0.6.51 contain a vulnerability where the download_agent_file endpoint creates temporary files that are not deleted after use. This allows an unauthenticated attacker to repeatedly invoke this endpoint, causing uncontrolled disk space consumption. The resulting exhaustion of disk space can lead to failures in the database or other system services, causing a denial of service that renders the AutoGPT backend unavailable. The issue is fixed in version 0.6.52.

Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to access these shared resources from another Guest VM, potentially resulting in the loss of confidentiality, integrity, or availability.

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.

Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the previous owners can gain unauthorized read and write access to it by using the previously generated access and secret keys. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

CVE-2026-35361 is a vulnerability in the mknod utility of uutils coreutils where device nodes are created before their SELinux security labels are set. If the labeling fails, the cleanup attempt does not remove the improperly labeled device nodes, leaving them with default contexts that may allow unauthorized access. This issue relates to improper preservation of permissions due to non-atomic handling of security labels.

nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.