16834 matches found
CVE-2026-93864
A link following vulnerability exists in the WatchGuard Fireware OS firewall daemon. A local attacker with code execution as a low-privileged system process can overwrite arbitrary files with root privileges and tamper with firewall IP set data. This is achieved by planting a crafted file system ...
CVE-2026-93864 Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...
CVE-2026-93865 Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is...
EUVD-2026-111158
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...
CVE-2026-13162
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting th...
CVE-2026-13162
An OS command vulnerability exists in the CoreTec product within the configuration daemon's time synchronization handler , which manages system time-zone settings. The flaw occurs because the daemon constructs shell commands by concatenating user-supplied input without sufficient sanitization or ...
EUVD-2026-110815
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting th...
CVE-2026-13162
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting th...
SUSE CVE-2026-77206
Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a...
SUSE CVE-2026-94453
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet retransmit or malicious is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to...
PT-2026-126390
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting th...
PT-2026-126645
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...
PT-2026-126646
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is...
libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS
A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...
libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP
A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this fla...
libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code
A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKEAUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The...
EUVD-2026-109933
The root-privileged wsserver terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to system and popen without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check...
libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP
A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this fla...
libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code
A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKEAUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The...
libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS
A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...