CVE-2026-19595

The user-mode syscall verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c validated its two output parameters, buff and bufflen, with KSYSCALLMEMORYREAD rather than KSYSCALLMEMORYWRITE. Both are pure out-parameters: zimplrtiocqegetmempoolbuffer stores the mempool buffer address an...

CVE-2026-19595 Zephyr RTIO syscall verifier validates output parameters for read instead of write access

The user-mode syscall verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c validated its two output parameters, buff and bufflen, with KSYSCALLMEMORYREAD rather than KSYSCALLMEMORYWRITE. Both are pure out-parameters: zimplrtiocqegetmempoolbuffer stores the mempool buffer address an...

CVE-2026-19595 Zephyr RTIO syscall verifier validates output parameters for read instead of write access

The user-mode syscall verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c validated its two output parameters, buff and bufflen, with KSYSCALLMEMORYREAD rather than KSYSCALLMEMORYWRITE. Both are pure out-parameters: zimplrtiocqegetmempoolbuffer stores the mempool buffer address an...

CVE-2026-19595

The Zephyr RTOS contains a vulnerability in the RTIO syscall verifier located in subsys/rtio/rtio_syscalls.c. The function z_vrfy_rtio_cqe_get_mempool_buffer() incorrectly validates the output parameters buff and buff_len using K_SYSCALL_MEMORY_READ() instead of K_SYSCALL_MEMORY_WRITE(). Because ...

CVE-2026-71490 OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write...

CVE-2026-71490

In versions of OPNsense prior to 26.1.11 , a flaw in OPNsense\Core\ACL::hasPrivilege() allows users to bypass MVC read-only write protection . The root cause is that directly assigned comma-separated values are appended as a single string and evaluated using an exact comparison when checking use...

CVE-2026-82358

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO Service Data Object server implementation 'src/cosdoserver.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload fo...

CVE-2026-82358 RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO Service Data Object server implementation 'src/cosdoserver.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload fo...

EUVD-2026-91024

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO Service Data Object server implementation 'src/cosdoserver.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload fo...

CVE-2026-82358 RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO Service Data Object server implementation 'src/cosdoserver.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload fo...

CVE-2026-82358

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO server implementation (src/co_sdo_server.c ). The vulnerability occurs because the system fails to properly validate write permissions when processing download-segment frames . An unauthenticated attacker on the CAN bus can i...

CVE-2026-82358 RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO Service Data Object server implementation 'src/cosdoserver.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload fo...

CVE-2026-82358: Incorrect Authorization

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO Service Data Object server implementation 'src/cosdoserver.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload fo...

PT-2026-103996

Name of the Vulnerable Software and Affected Versions RT-Labs AB C-Open CANopen versions prior to 1.1.1 Description A write protection bypass exists in the SDO Service Data Object server implementation within src/co sdo server.c. The issue occurs because the system fails to properly validate writ...

CVE-2026-34949

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3...

CVE-2026-34949

Combodo iTop versions prior to 3.2.3 are affected by an unauthenticated file deletion vulnerability. An attacker with no credentials can delete the .readonly file, which is created during the setup process to prevent users from performing write actions. Removing this file effectively disables the...

Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Reliabl...

CVE-2026-25722

Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protecti...

CVE-2026-25722 Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection

Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protecti...

CVE-2026-25722

Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protecti...