CWE-345

CWE-345 · 7 records · 1 with a public proof-of-concept

Records the NVD classes under CWE-345, highest CVSS first.

  1. CRITICAL 9.6CVE-2026-734372026-09-15

    On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and…

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 8.2CVE-2026-734352026-09-16

    On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency fl…

    AI risk analysis on Exploit-DB.ai →

  3. MEDIUM 6.9CVE-2026-734502026-09-16

    On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG…

    AI risk analysis on Exploit-DB.ai →

  4. MEDIUM 6.5CVE-2026-67618public PoC2026-08-04

    marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged into session configuration with higher prec…

    AI risk analysis on Exploit-DB.ai →

  5. MEDIUM 5.3CVE-2026-849062026-09-16

    The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs t…

    AI risk analysis on Exploit-DB.ai →

  6. MEDIUM 4.4CVE-2026-779552026-09-16

    In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to …

    AI risk analysis on Exploit-DB.ai →

  7. MEDIUM 4.3CVE-2026-856412026-09-16

    The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated …

    AI risk analysis on Exploit-DB.ai →