CVE-2026-86133

An integer underflow vulnerability exists in the WatchGuard Fireware OS IKE daemon (iked ). A remote attacker who has completed the initial IKEv2 handshake can crash the iked process by sending a specially crafted encrypted IKEv2 message, leading to a denial of service . No specific exploit detai...

CVE-2026-86131 Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox...

CVE-2026-86132 Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service

An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon iked allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite...

CVE-2026-18145

The WatchGuard Fireware OS contains a stack-based buffer overflow vulnerability within the spamBlocker (spamd) service. An authenticated attacker possessing administrator privileges can exploit this flaw by sending a specially crafted management request. Successful exploitation could result in a ...

CVE-2026-13224

A path traversal vulnerability exists in the Fireware OS WebUI management agent . This flaw allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request. The vulnerability impacts the confidentiality of local syste...

CVE-2026-90441 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user including a read-only or guest administrator account to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a...

CVE-2026-90441 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user including a read-only or guest administrator account to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a...

CVE-2026-86133 Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service

An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon iked allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service...

CVE-2026-86128 Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service

A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet...

CVE-2026-18105 Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

CVE-2026-18105 Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

CVE-2026-90441

The Fireware OS is affected by a missing authorization vulnerability in the wgagent management daemon's session initialization function. An authenticated, low-privileged user—such as a guest or read-only administrator—can submit a specially crafted management API request to crash the wgagent proc...

CVE-2026-86128 Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service

A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet...

CVE-2026-86136 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user including a read-only or guest administrator account to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a...

CVE-2026-86128

A NULL pointer dereference vulnerability exists in the Fireware OS NetFlow packet-processing feature. This flaw allows a remote, unauthenticated attacker to trigger a denial of service (DoS) by sending a specially crafted IPv6 packet . No specific affected versions, remediation steps, or exploita...

CVE-2026-86131 Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox...

CVE-2026-86101

A remote, authenticated SAML user can exploit an improper authorization vulnerability in the WatchGuard Fireware OS SAML login process. By sending a specially crafted request, an attacker with legitimate access only to the Access Portal can obtain unauthorized Mobile VPN with SSL access . No spec...

CVE-2026-79535

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

CVE-2026-100292 Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...

CVE-2026-100292

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 , an authenticated request can enable a hidden debug interface . This interface allows additional commands to be sent to a backend service, potentially exposing system-level functionality . If crafted inputs reach the underlying command handler, ...