CVE-2026-38974

MediumCVSS 5.3/10Last modified Jul 16, 2026

Description

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Jul 15, 2026
Last modified
Jul 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-389767.5mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard forCVE-2026-389785.3transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.CVE-2026-389795.4ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTCVE-2026-389918.8Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially craftCVE-2026-389929.8Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerabilityCVE-2026-389936.5Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackersCVE-2026-389986.5A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.CVE-2026-389997.5A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0c16 allows attackersCVE-2026-390069.8An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.CVE-2026-390077.5An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information via the CSV Log export comCVE-2026-39027.5An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headeCVE-2026-390205.5An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file
CVE-2026-38974: Medium severity, CVSS 5.3 | Vulnix