CVE-2026-86345
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating Star
CVSS
9.0
Crítico
EPSS
0.4%
p31
KEV
—
Exploit Today
9
0-100
Publicado: 2 oct 2026 · Última mod.: 7 oct 2026 · CWE-923
0.4%EPSS · 30 días0.4%
2026-10-022026-10-19
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in place of the client's own pending operation's response, due to messageID collision. This can cause a client application to treat a failed authentication (bind) attempt as successful.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1109095.0 MED0.6%
——0Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.1dCVE-2026-1020856.5 MED19.9%
——6An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device.
Due to a wrong initialization, a process which should only be able to communicate internally within the device can be reached over the network via an open port. This leads to a device being inadvertently exposed and increased CPU cycles spent processing ingress packets.
This issue affects Junos OS Evolved:
* All versions before 23.2R2-S7.7-EVO;
* 23.4 versions before 23.4R2-S8.11-EVO;
* 24.2 versions before 24.2R2-S5.6-EVO;
* 24.4 versions before 24.4R2-S4-EVO;
* 25.2 version before 25.2R2-S1-EVO;
* 25.4 versions before 25.4R1-S1-EVO.
Please note that this issue is similar to but not identical CVE-2026-33803.6dCVE-2026-859258.2 ALT38.8%
——12Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.5dCVE-2026-702127.0 ALT14.3%
——4Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.5dCVE-2026-921739.1 CRÍ20.0%
——6Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication.20dCVE-2026-921728.8 ALT20.0%
——6Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication.20d