CVE-2026-58096

The ppp(8) utility in the FreeBSD operating system kernel contains a memory safety vulnerability in the LcpDecodeConfig() function. The flaw exists because the function fails to validate the length of received endpoint discriminator options against the minimum requirements specified in RFC 1717 ,...

CVE-2026-58096 ppp(8): missing length validation in LcpDecodeConfig()

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

EUVD-2026-66246

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58095

The FreeBSD operating system is vulnerable to a buffer overflow in the ppp(8) utility due to incorrect length calculations within the mp_Enddisc() function. When formatting endpoint discriminator addresses for display, a received endpoint option can overflow a global result buffer. A malicious PP...

CVE-2026-58095 ppp(8): incorrect length calculation in mp_Enddisc()

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-80195

Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...

EUVD-2026-66174

A SQL injection vulnerability in the tags manager in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersmod privileges to execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to...

EUVD-2026-66167

A Broken access control vulnerability in the API user endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created...

PT-2026-81940

mp SetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-80347: Server-Side Request Forgery (SSRF)

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...

PT-2026-81938

mp Enddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

PT-2026-82236

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USER ID endpoint...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098687)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098687 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARNON for device endpoint command timeouts This commit addresses a rarely...

PT-2026-81966

The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings...

CVE-2026-75330

The front-end interface /superdiamond/preview/projectCode/module/type of super-diamond-server = 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split and string concatenation without being parameterized and bound...

PT-2026-81939

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

EUVD-2026-66661

DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/' parameters...

CVE-2026-80428: Deserialization of Untrusted Data

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

CVE-2025-61162

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints. The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to...