PT-2026-123216

A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin init of the file /tmp/upload files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd options leads to unrestricted upload. The attack may be launched...

Debian: CVE-2026-75131: network-manager-l2tp -- security update

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote...

CVE-2026-75131: Improper Neutralization of Argument Delimiters in a Command

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-381272)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-381272 advisory. In the Linux kernel, the following vulnerability has been resolved: ppp: Fix KMSAN uninit-value warning with bpf Syzbot caught an KMSAN: uninit-value warning 1, whi...

AZL-59973 CVE-2025-21922 affecting package kernel for versions less than 5.15.180.1-1

In the Linux kernel, the following vulnerability has been resolved: ppp: Fix KMSAN uninit-value warning with bpf Syzbot caught an "KMSAN: uninit-value" warning 1, which is caused by the ppp driver not initializing a 2-byte header when using socket filter. The following code can generate a PPP...