CVE WatchOct 26, 2026

CVE-2026-44474

Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of secu

CVSS

3.7

Low

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: May 27, 2026 · Last modified: Oct 26, 2026 · CWE-358

EPSS · 30d

0.1%EPSS · 30 days0.2%

2026-09-282026-10-25

Technical description

Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa). Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger. This vulnerability is fixed in 1.10.0.

Official references

github.comhttps://github.com/ellanetworks/core/security/advisories/GHSA-mc29-hmx6-856q

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-963036.5 MED

52.5%

——16Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over a network.5d CVE-2026-858056.5 MED

48.1%

——14Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.11d CVE-2026-701748.8 HIG

59.8%

——18Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.5d CVE-2026-967609.8 CRI

32.1%

——10Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.26d CVE-2026-465823.7 LOW

8.4%

——3In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC accompanying rrset.3d CVE-2026-650585.3 MED

33.8%

——10Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present calldata to a victim then supply a different tail that changes the signed transaction. Fixed in 70c9b0c.89d