freebsd-CVE-2026-7270

Ref https://github.com/califio/publications/tree/main/MADBugs/freebsd-CVE-2026-7270 CVE-2026-7270 FreeBSD 로컬 권한 상승 —execargsadjustargs OOB memmove execargsadjustargssys/kern/kernexec.c, 2013년부터 존재의 연산자 우선순위 버그로 인해, sshd가 실행 중인 기본 FreeBSD 설치 환경에서 모든 로컬 사용자가 root로 권한을 상승시킬 수 있습니다. suid 바이너리, 커널 모듈,...

CVE-2026-92932

In the MISP sachertortephp library, the Xml::build static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options'readFile' && strpos$input, 'http://' === 0 || strpos$input, 'https://' === ...

CVE-2026-92932

CVE-2026-92932 affects the MISP sachertortephp library, specifically the Xml::build() static method in lib/Cake/Utility/Xml.php. The root cause is a PHP operator precedence error : the condition $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0 evaluates ...

CVE-2026-92932 MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled

In the MISP sachertortephp library, the Xml::build static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options'readFile' && strpos$input, 'http://' === 0 || strpos$input, 'https://' === ...

EUVD-2026-81474

In the MISP sachertortephp library, the Xml::build static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options'readFile' && strpos$input, 'http://' === 0 || strpos$input, 'https://' === ...

CVE-2026-92932 MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled

In the MISP sachertortephp library, the Xml::build static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options'readFile' && strpos$input, 'http://' === 0 || strpos$input, 'https://' === ...

CVE-2026-92932 MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled

In the MISP sachertortephp library, the Xml::build static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options'readFile' && strpos$input, 'http://' === 0 || strpos$input, 'https://' === ...

CVE-2026-52730 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

CVE-2026-52730

Xibo CMS prior to version 4.4.3 contains a missing authorization vulnerability in Module::settingsForm caused by PHP operator precedence . This allows an authenticated user with the Module View feature—which is not granted to non-admins by default—to view (but not change) super admin-restricted m...

CVE-2026-52730 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

CVE-2026-52730 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: l2tp: The correct message length must be passed to ip6.AppendData. l2tpip6sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff. To address this issu...

CVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-71259: Incomplete List of Disallowed Inputs

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-67207

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the...

CVE-2026-67207: Incorrect Comparison

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the...

CVE-2026-14923: Incorrect Authorization

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

The vulnerability of the do_read inode() function in the fs/f2fs/inode.c module of the F2FS file system in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the doread inode function in the fs/f2fs/inode.c module of the F2FS file system in the Linux operating system is related to a logical error in the operator precedence. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-44722 pyzipper: Encryption bypass for small files encrypted with pyzipper

pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python operator precedence bug in pyzipper/zipfileaes.py caused the AE-2 format to never be automatically selected during encryption, causing encrypted entries to be written in AE-1...

CVE-2026-44722: Use of Incorrect Operator

pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python operator precedence bug in pyzipper/zipfileaes.py caused the AE-2 format to never be automatically selected during encryption, causing encrypted entries to be written in AE-1...