EUVD-2026-67946

Zephyr's WireGuard VPN data-plane receive handler wgprocessdatamessage in subsys/net/lib/wireguard/wgcrypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGETRANSPORTDATA packet succeeded, the code committed several peer-state changes — updatepeeraddr endpoint roami...

CVE-2026-13734 Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijack

Zephyr's WireGuard VPN data-plane receive handler wgprocessdatamessage in subsys/net/lib/wireguard/wgcrypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGETRANSPORTDATA packet succeeded, the code committed several peer-state changes — updatepeeraddr endpoint roami...

CVE-2026-13734

Zephyr RTOS's WireGuard data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter only after committing several peer-state mutations (endpoint roaming update, liveness timers, and keypair rotation). Because the AEAD tag authenti...

CVE-2026-13734 Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijack

Zephyr's WireGuard VPN data-plane receive handler wgprocessdatamessage in subsys/net/lib/wireguard/wgcrypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGETRANSPORTDATA packet succeeded, the code committed several peer-state changes — updatepeeraddr endpoint roami...

CVE-2026-82267

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2026-55545

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

CVE-2026-54766

Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/projectduplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project...

GHSA-F97C-PH8J-8VFF Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

Summary The Studio API class definition creation endpoint in pimcore/studio-backend-bundle is guarded by the objects permission instead of the classes permission, allowing any standard editor-level user to create class definitions without admin privileges. Class definition creation is a structura...

Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

Summary The Studio API class definition creation endpoint in pimcore/studio-backend-bundle is guarded by the objects permission instead of the classes permission, allowing any standard editor-level user to create class definitions without admin privileges. Class definition creation is a structura...

Snipe-IT has an authorization bypass on print inventory page

Impact An authenticated user with only users.view can open another user's detail page and see assigned license, accessory, and consumable data even though the same account is denied direct access to the Licenses, Accessories, and Consumables modules. The leaked data includes software license name...

GHSA-VGX7-C78R-69W9 Snipe-IT has an authorization bypass on bulk editing users

Impact An authenticated non-admin user with users.view and users.edit, but without users.delete, can directly POST to /users/bulksave and soft-delete another non-admin user. The UI and confirmation route require users.delete, but the destructive sink only authorizes update. Attacker Model...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the WebSocket subscription handlers for packets, algorithm-status, and mdb-changes. An attacker can access sensitive data by subscribing to these WebSocket topics without the privilege checks that are enforced i...

CVE-2026-55545 Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

CVE-2026-55545

CVE-2026-55545 is an authorization bypass in Yamcs , a mission control framework, affecting versions prior to 5.12.8 and 5.13.2 . Three WebSocket subscription handlers fail to enforce the privilege checks their REST counterparts require: PacketsApi.subscribePackets omits the ReadPacket check, Pro...

CVE-2026-55545 Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

SUSE CVE-2026-74361

In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdpidx when it equals n i.e. NUMFDPC + 1...

SUSE CVE-2026-74649

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

Vikunja has a project duplication bypasses write-permission check on the target parent project

Summary The project-duplication endpoint fails to enforce write access to the target parent project. Any authenticated non-link-share user can duplicate a project they can read into any parent project on the instance, regardless of whether they have write access to that parent — injecting an...

SUSE CVE-2026-80582

In the Linux kernel, the following vulnerability has been resolved: drm/shmemhelper: Check VMA boundaries for PMD mappings In the -hugefault handler do not install a PMD huge page mapping if the huge page exceeds the boundaries of the VMA. All other -hugefault handlers have similar checks and the...

CVE-2026-54766 Vikunja: Project duplication bypasses write-permission check on the target parent project

Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/projectduplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project...