CVE-2026-121290
On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables def
CVSS
8.2
Alta
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-420
Ainda não há histórico EPSS suficiente.
On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables default protective Access Control List (ACL) rules against unexpected BGP peering attempts.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1050089.0 CRÍ52.1%
——16No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.15dCVE-2026-1021345.4 MÉD11.1%
——3Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied.41dCVE-2026-619093.5 BAI10.5%
——3An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.56dCVE-2026-776395.3 MÉD33.5%
——10Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.23dCVE-2026-404355.3 MÉD13.7%
——4When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.16dCVE-2026-402178.8 ALT97.1%
——29LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.15d