CVE-2026-73453 is a critical vulnerability in Arista Networks EOS involving improper control of code generation (CWE-94). An unauthenticated attacker can exploit the P4Runtime feature, if enabled, to execute arbitrary code and gain full administrative control of the affected switch. P4Runtime is disabled by default. No known exploitation in the wild has been reported. The vulnerability affects multiple versions of Arista EOS from before 4.29.2F up to 4.36.1F.
CVE-2026-73464 is a high-severity vulnerability in Arista Networks EOS affecting versions from 4.29.0F up to and including 4.36.0.1F. It involves improper control of code generation (CWE-94) in the gRPC Network Management Interface (gNMI). An authenticated client with gNMI access could send a specially crafted request to execute arbitrary code with root privileges on the switch.
CVE-2026-73439 is a high-severity vulnerability in Arista Networks EOS affecting versions 4.33.2F through 4.33.8M, 4.34.0F through 4.34.6M, 4.35.0F through 4.35.5M, and 4.36.0F through 4.36.0.1F. It occurs when OpenConfig is configured with a gNMI server and a gNSI Pathz policy containing both group and user rules for the same path. Under these conditions, gNMI may fail to enforce the Pathz policy correctly, allowing an authenticated user to gain unauthorized read or write permissions on restricted gNMI paths. The vulnerability has a CVSS 3.1 score of 7.5, indicating high impact on confidentiality, integrity, and availability. No information about patches or vendor advisories is provided, so patch status is not confirmed.
CVE-2026-73461 is a high-severity vulnerability in Arista Networks EOS affecting versions from 4.29.0F up to and including 4.36.0.1F. It involves incorrect privilege assignment in AAA-based gRPC authorization for OpenConfig, where authenticated users may receive incorrect privilege levels, causing authorization with the wrong AAA method list. This issue does not affect non-gRPC OpenConfig requests such as NETCONF.
CVE-2026-73459 is a high-severity vulnerability in Arista Networks EOS affecting versions 4.36.0 through 4.36.1F. It involves improper validation of integrity check values in the IS-IS protocol implementation. An unauthenticated attacker able to inject specially crafted IS-IS LSP PDUs can cause legitimate LSPs to be purged unexpectedly from the IS-IS link-state database, potentially resulting in traffic loss.
A vulnerability in Arista Networks EOS allows an unauthenticated attacker to disrupt IS-IS adjacencies by sending crafted IS-IS Hello PDUs on broadcast interfaces. This can cause traffic disruption and loss of IP reachability for prefixes advertised through the affected adjacency. The issue affects multiple versions of EOS from 4.31.0 through 4.36.1F. The vulnerability has a high severity rating with a CVSS score of 7.4.
CVE-2026-73467 is a vulnerability in Arista Networks EOS where plaintext shared secrets for configured TACACS+ servers may be inserted into log files under certain conditions. This exposure of sensitive information could lead to confidentiality, integrity, and availability impacts. The vulnerability affects multiple versions of EOS up to and including 4.36.1F. The CVSS 3.1 base score is 6.3, indicating a medium severity level. No vendor advisory or patch information is provided, so patch status is not confirmed.
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.
ZoneMinder versions prior to 1.36.39, 1.38.4, and 1.39.11 contain an authorization bypass vulnerability allowing authenticated low-privileged users with Events=View and/or Snapshots=View permissions to access private surveillance media from monitors they should not have access to. The user interface hides restricted monitors, but direct media requests using arbitrary event IDs bypass access controls, exposing private footage. The issue is fixed in versions 1.36.39, 1.38.4, and 1.39.11.
## Summary
Three Livewire admin components in `shopper/framework` (latest master at commit `fcd0c59`, released as v2.8.0) gate state-mutating actions on the read-only `view_users` permission. This is the same class as the issue Shopper fixed in v2.8.0 / PR #511 / [GHSA-f946-9qp6-vgch](https://github.com/shopperlabs/shopper/security/advisories/GHSA-f946-9qp6-vgch) — the PR moved most write actions from `view_users` to `access_setting`, but three were missed (one of them is a brand-new file added by the security commit itself).
A staff user holding only `view_users` + `access_dashboard` (a realistic "support" or "viewer" role per Shopper's own `PermissionsTableSeeder`) can: (1) self-escalate by granting any permission to their own role; (2) create a brand-new admin team member with a chosen password and the `admin` role and then log in as that user; (3) delete arbitrary `permissions` rows (RBAC DoS) or — when `can_be_removed=true` — delete entire roles.
CVSS 3.1: `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` = 8.8 (High). CWE-285 (Improper Authorization) + CWE-862 (Missing Authorization).
## Vulnerable components (paths relative to repo root)
### 1) `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`
- `togglePermission(int $id)` at line 28 calls `$this->authorize('view_users');`
- `removePermission(int $id)` at line 55 calls `$this->authorize('view_users');`
The Permissions blade at `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` line 34 emits every permission's `id` directly in `wire:click` handlers, so the attacker does not even need to guess IDs — the page itself enumerates them.
Net effect: any user who can mount the Permissions component (gated on `view_users`) can grant any permission row to the bound `$role`. Granting `access_setting` to the attacker's own role unlocks every action that PR #511 supposedly hardened with `->authorize('access_setting')`. Granting `delete_customers`, `edit_orders`, `edit_products`, `add_brands`, etc. is direct data-modification escalation.
### 2) `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`
- `mount()` at line 53 calls `$this->authorize('view_users');`
- `store()` at line 122 calls `$this->authorize('view_users');`
This file is `new file mode 100755` in commit `fcd0c59` — it was created as part of the security fix and inherited the same misclassified gate.
`store()` creates a `User` with `email_verified_at = now()`, the attacker's chosen password, and any selected `role_id`. The `Radio::make('role_id')` options filter only excludes `config('shopper.admin.roles.user')`, so the `admin` role is selectable. Log out, log in as the new account → full admin.
### 3) `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`
- `deleteAction` at lines 81-90: only gated by `->visible($this->role->can_be_removed)`, with no `->authorize()` chain.
Page-level `mount` (line 52) requires only `view_users`. For any role with `can_be_removed = true`, a `view_users`-only user can call the action and delete the role (cascading the loss of permissions for every assigned user).
## Self-confirmation in the project's own test suite
The following tests are green on master @ `fcd0c59` — they ARE the PoC:
```
tests/Admin/Livewire/Components/Settings/Team/PermissionsTest.php
line 14-16: `givePermissionTo('view_users')` only
line 36-45: "can toggle permission to role" — passes
line 74-85: "can remove permission" — passes
tests/Admin/Livewire/SlideOvers/CreateTeamMemberTest.php
line 16-18: `givePermissionTo('view_users')` only
line 29-56: "can create new team member" — passes, asserts the new user `hasRole('manager')`
```
A `view_users`-only Livewire user actor successfully toggles permissions, removes permissions, and creates a new privileged user — verified by Shopper's own regression tests.
## Suggested fix
Change `$this->authorize('view_users')` to `$this->authorize('access_setting')` in:
- `Permissions::togglePermission`
- `Permissions::removePermission`
- `Permissions::mount` (defence in depth, matches `Team\Index`)
- `CreateTeamMember::mount`
- `CreateTeamMember::store`
Add `->authorize('access_setting')` to `RolePermission::deleteAction` (matches the pattern already applied to `generatePermissionsAction`, `createPermissionAction`, and `Team\Index::DeleteAction`).
Update the two regression tests to use `access_setting` instead of `view_users` so they accurately reflect the privilege boundary.
## Resources
- Prior advisory of the same class: https://github.com/shopperlabs/shopper/security/advisories/GHSA-f946-9qp6-vgch
- Fix commit that introduced these residual gaps: https://github.com/shopperlabs/shopper/commit/fcd0c5920588702df5b874f432b1042abd77a50b
- CWE-285 Improper Authorization
- CWE-862 Missing Authorization
### Credits
Reported by Vishal Shukla(@shukla304) using sechub.dev AI Agent
### Support
If this disclosure was useful and if users would like to support continued o
CVE-2026-89738 is a use-after-free vulnerability in the Linux kernel's at91_udc USB gadget driver. It occurs because a polled-VBUS timer and associated work are not properly drained before the USB device controller (udc) is freed during driver removal or probe failure. This can lead to dereferencing freed memory, causing potential system crashes or escalation of privileges. The issue affects Linux kernel version 2.6.36 and has been fixed in subsequent commits.
CVE-2026-82092 is an absolute path traversal vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. This flaw allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.
A SQL injection vulnerability (CWE-89) exists in the JasperReports-based reporting feature of OpenNMS Meridian and Horizon. A low-privileged authenticated user can exploit this by supplying a crafted DATE_FORMAT parameter to certain default-enabled reports via the reporting REST API, leading to arbitrary SQL execution and unauthorized data access. The vulnerability affects specific versions of Meridian and Horizon prior to fixed releases. Upgrading to Meridian 2024.3.13, 2025.0.10 or Horizon 36.0.4 or newer mitigates the issue. These products are intended for private network deployment and not direct Internet exposure.
An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled (for example a compromised monitored host or an HTTP man-in-the-middle position), the collector's XML parser resolves external entities and external DTDs. This allows an attacker to read files accessible to the OpenNMS service account, including database credentials, and to induce out-of-band requests.
The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration and SNMP data collection (which enable and disable event definitions and data-collection sources) are reachable with no authorization enforced. An unauthenticated attacker able to reach the web UI can disable event definitions and SNMP data collection, suppressing event and alarm generation and stopping metric collection - silently degrading monitoring and detection - with the change persisted and reloaded into the running system.
The solution is to upgrade to Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
A path traversal vulnerability in Plesk's Backup Manager allows an authenticated customer to write arbitrary files as root. This vulnerability can lead to complete system compromise due to the high privileges involved.
CVE-2026-85228 is a critical integer overflow vulnerability in the tensor buffer validation component of Amazon Deep Java Library (DJL) versions 0.13.0 through 0.36.0. This flaw could allow a remote unauthenticated attacker to read adjacent process memory or cause a denial of service by sending a specially crafted tensor payload. The issue is fixed in version 0.37.0 and later.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to script injection.