CVE Watch19 oct 2026

CVE-2026-43033

In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-place

CVSS

7.8

Alto

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 1 may 2026 · Última mod.: 19 oct 2026 · CWE-682

EPSS · 30d

0.1%EPSS · 30 días0.2%

2026-09-282026-10-26

Descripción técnica

In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption When decrypting data that is not in-place (src != dst), there is no need to save the high-order sequence bits in dst as it could simply be re-copied from the source. However, the data to be hashed need to be rearranged accordingly. Thanks,

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1165415.9 MED

—

——0Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.19h CVE-2026-1157866.5 MED

31.2%

——9A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20.4d CVE-2026-202367.5 ALT

37.9%

——11As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20236 are related to issues concerning incorrect calculation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-682.1d CVE-2026-1141175.9 MED

21.9%

——7Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.6d CVE-2026-1019637.5 ALT

38.5%

——12An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.12d CVE-2026-1094102.4 BAJ

18.7%

——6A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the function OmsOrderServiceImpl.updateMoneyInfo of the file /order/update/moneyInfo of the component mall-admin/mall-portal. The manipulation leads to incorrect calculation. The attack can be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.11d