NCSC-2026-0404
Vulnerability from csaf_ncscnl - Published: 2026-10-07 07:27 - Updated: 2026-10-07 07:27Summary
Kwetsbaarheden verholpen in WatchGuard Fireware OS
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: WatchGuard heeft meerdere kwetsbaarheden verholpen in Fireware OS.
Interpretaties: De impact van deze kwetsbaarheden varieert, net als de toegangsrechten die nodig zijn voor misbruik.
- Een aanvaller met schrijfrechten op het systeem kan via een kwetsbaarheid in SAML single sign-on-sessies een kwaadaardig sessiebestand laden en arbitraire code uitvoeren.
- Geauthenticeerde beheerders kunnen via path traversal in de WebUI Management Agent willekeurige lokale bestanden lezen. Een low-privileged geauthenticeerde gebruiker kan via resource-uitputting van diagnostische tools een denial-of-service veroorzaken.
- De spamBlocker-service bevat een stack-based buffer overflow die door een geauthenticeerde beheerder kan leiden tot een crash of code-executie.
- Een stack-based buffer overflow in de DHCP fingerprinting-daemon kan door een niet-geauthenticeerde aanvaller met netwerktoegang worden misbruikt voor code-executie of een crash.
- Een geauthenticeerde gebruiker met beperkte Access Portal-rechten kan via een SAML-login kwetsbaarheid ongeautoriseerde toegang tot Mobile VPN with SSL verkrijgen.
- Een remote, niet-geauthenticeerde aanvaller kan via resource-uitputting in het wgagent-loginproces een denial-of-service veroorzaken.
- De Access Portal reverse proxy bevat een improper authorization-kwetsbaarheid waardoor geauthenticeerde gebruikers met beperkte rechten toegang kunnen krijgen tot ongeautoriseerde webapplicaties.
- Een NULL pointer dereference in de NetFlow-packetverwerking kan door een remote, niet-geauthenticeerde aanvaller een crash veroorzaken.
- De BOVPN Over TLS-clientconfiguratie bevat een code-injection-kwetsbaarheid waardoor een aanvaller die de remote VPN-server beheert commando's met rootrechten kan uitvoeren op het Firebox-apparaat.
- Integer-underflow kwetsbaarheden in de IKE- en IKEv2-daemons kunnen door remote, niet-geauthenticeerde aanvallers worden misbruikt om crashes en daarmee denial-of-service te veroorzaken.
- Een NULL pointer dereference in het authenticatieproces kan door een remote, niet-geauthenticeerde aanvaller een crash van de managementdaemon veroorzaken.
- Een OS command injection in de interne API van WatchGuard Access Points kan door een aanvaller met netwerktoegang worden misbruikt voor het uitvoeren van willekeurige commando's.
- Een CSRF-kwetsbaarheid in WatchGuard Dimension kan het mogelijk maken om zonder toestemming database snapshots te creëren.
- Een missing authorization-kwetsbaarheid in de wgagent Management API kan door geauthenticeerde gebruikers met beperkte rechten worden misbruikt voor ongeautoriseerde API-verzoeken, crashes en het lezen van willekeurige bestanden.
- Een kwetsbaarheid in libxml2 kan leiden tot een out-of-bounds read en denial-of-service bij het verwerken van XML-input.
Oplossingen: WatchGuard heeft updates uitgebracht om de kwetsbaarheden in Fireware OS te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23: Relative Path Traversal
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-121: Stack-based Buffer Overflow
CWE-176: Improper Handling of Unicode Encoding
CWE-191: Integer Underflow (Wrap or Wraparound)
CWE-295: Improper Certificate Validation
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
CWE-476: NULL Pointer Dereference
CWE-502: Deserialization of Untrusted Data
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-787: Out-of-bounds Write
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
CWE-862: Missing Authorization
CWE-863: Incorrect Authorization
CWE-1284: Improper Validation of Specified Quantity in Input
A vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling allows attackers with file write access to execute arbitrary code by loading a malicious session file.
CWE-502 - Deserialization of Untrusted DataAffected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
WatchGuard / Fireware
|
vers:unknown/* | ||
|
vers:unknown/*
WatchGuard / Fireware OS
|
vers:unknown/* |
A path traversal vulnerability in Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary local files via crafted management requests.
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
A vulnerability in pretix allows malicious HTML injection into the email address field of an order, which is then rendered unsanitized on the individual ticket confirmation page.
CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
An uncontrolled resource consumption vulnerability in Fireware OS allows a low-privileged authenticated user to cause denial of service of diagnostic tools by repeatedly starting and aborting a crafted diagnostic task via the web UI.
CWE-770 - Allocation of Resources Without Limits or ThrottlingAffected products
Known affected
2 products, the same list as for
CVE-2026-13046
A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's spamBlocker (spamd) service allows an authenticated administrator to crash the service or potentially execute arbitrary code via a crafted management request.
CWE-121 - Stack-based Buffer OverflowAffected products
Known affected
2 products, the same list as for
CVE-2026-13046
The Fluent Forms WordPress plugin up to version 6.2.11 contains a Stored Cross-Site Scripting vulnerability via Notification Smartcode Values, enabling unauthenticated attackers to execute malicious scripts in the browsers of privileged users viewing form submission logs.
7.2 (High)
Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
A stack-based buffer overflow in WatchGuard Fireware OS's DHCP fingerprinting daemon allows unauthenticated adjacent attackers to execute arbitrary code or crash the process via crafted DHCP packets.
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
A vulnerability in WatchGuard Fireware OS's SAML login enables an authenticated user with limited Access Portal rights to escalate privileges and gain unauthorized Mobile VPN with SSL access via a crafted request.
CWE-863 - Incorrect AuthorizationAffected products
Known affected
2 products, the same list as for
CVE-2026-13046
An OS command injection vulnerability in the WatchGuard AP internal API service allows attackers with network access to execute arbitrary shell commands on the device's operating system.
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
A resource consumption vulnerability in Fireware OS's wgagent login process allows remote, unauthenticated attackers to cause denial of service by sending specially crafted requests.
7.5 (High)
Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy enables authenticated low-privileged users to access unauthorized web applications by crafting specific requests for accessible resources.
7.1 (High)
Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
A vulnerability in VeloCloud Edge HA allows unauthenticated actors with Layer 2 access to the private HA interconnect to trigger sensitive HA peer functions, potentially leading to elevated command execution without verification.
9.6 (Critical)
Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause denial of service by sending a specially crafted IPv6 packet.
7.5 (High)
Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration enables a remote VPN server attacker to execute arbitrary root commands on the connecting Firebox device.
9.8 (Critical)
Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
An integer underflow vulnerability in WatchGuard Fireware OS IKEv2 daemon allows remote unauthenticated attackers to crash the process via a crafted encrypted IKEv2 message using AES-GCM cipher suite.
7.5 (High)
Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
An integer underflow vulnerability in WatchGuard Fireware OS IKE daemon allows remote attackers to crash the iked process and cause denial of service via a crafted encrypted IKEv2 message post-handshake.
7.5 (High)
Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
A NULL pointer dereference vulnerability in WatchGuard Fireware OS's authentication process allows remote unauthenticated attackers to crash the management daemon via crafted login requests, resulting in denial of service.
7.5 (High)
Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
A CSRF vulnerability in WatchGuard Dimension allows remote attackers to trick authenticated administrators into creating unauthorized database snapshots via malicious web pages.
CWE-352 - Cross-Site Request Forgery (CSRF)Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
A missing authorization vulnerability in the wgagent management daemon enables an authenticated low-privileged user to crash the process and read arbitrary files via a specially crafted API request.
8.1 (High)
Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
In libxml2 versions prior to 2.15.4, the xmlFAParsePosCharGroup function contains an out-of-bounds read vulnerability related to the NXT macro in xmlregexp, which can cause denial of service via specially crafted XML input.
CWE-125 - Out-of-bounds ReadAffected products
Known affected
2 products, the same list as for
CVE-2026-13046
A missing authorization vulnerability in the wgagent management daemon enables an authenticated low-privileged user to crash the process and read arbitrary files via a specially crafted API request.
8.1 (High)
Affected products
Known affected
2 products, the same list as for
CVE-2026-13046
References
43 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "WatchGuard heeft meerdere kwetsbaarheden verholpen in Fireware OS.",
"title": "Feiten"
},
{
"category": "description",
"text": "De impact van deze kwetsbaarheden varieert, net als de toegangsrechten die nodig zijn voor misbruik.\n\n- Een aanvaller met schrijfrechten op het systeem kan via een kwetsbaarheid in SAML single sign-on-sessies een kwaadaardig sessiebestand laden en arbitraire code uitvoeren.\n- Geauthenticeerde beheerders kunnen via path traversal in de WebUI Management Agent willekeurige lokale bestanden lezen. Een low-privileged geauthenticeerde gebruiker kan via resource-uitputting van diagnostische tools een denial-of-service veroorzaken. \n- De spamBlocker-service bevat een stack-based buffer overflow die door een geauthenticeerde beheerder kan leiden tot een crash of code-executie. \n- Een stack-based buffer overflow in de DHCP fingerprinting-daemon kan door een niet-geauthenticeerde aanvaller met netwerktoegang worden misbruikt voor code-executie of een crash. \n- Een geauthenticeerde gebruiker met beperkte Access Portal-rechten kan via een SAML-login kwetsbaarheid ongeautoriseerde toegang tot Mobile VPN with SSL verkrijgen. \n- Een remote, niet-geauthenticeerde aanvaller kan via resource-uitputting in het wgagent-loginproces een denial-of-service veroorzaken. \n- De Access Portal reverse proxy bevat een improper authorization-kwetsbaarheid waardoor geauthenticeerde gebruikers met beperkte rechten toegang kunnen krijgen tot ongeautoriseerde webapplicaties.\n- Een NULL pointer dereference in de NetFlow-packetverwerking kan door een remote, niet-geauthenticeerde aanvaller een crash veroorzaken. \n- De BOVPN Over TLS-clientconfiguratie bevat een code-injection-kwetsbaarheid waardoor een aanvaller die de remote VPN-server beheert commando\u0027s met rootrechten kan uitvoeren op het Firebox-apparaat.\n- Integer-underflow kwetsbaarheden in de IKE- en IKEv2-daemons kunnen door remote, niet-geauthenticeerde aanvallers worden misbruikt om crashes en daarmee denial-of-service te veroorzaken. \n- Een NULL pointer dereference in het authenticatieproces kan door een remote, niet-geauthenticeerde aanvaller een crash van de managementdaemon veroorzaken. \n- Een OS command injection in de interne API van WatchGuard Access Points kan door een aanvaller met netwerktoegang worden misbruikt voor het uitvoeren van willekeurige commando\u0027s.\n- Een CSRF-kwetsbaarheid in WatchGuard Dimension kan het mogelijk maken om zonder toestemming database snapshots te cre\u00ebren. \n- Een missing authorization-kwetsbaarheid in de wgagent Management API kan door geauthenticeerde gebruikers met beperkte rechten worden misbruikt voor ongeautoriseerde API-verzoeken, crashes en het lezen van willekeurige bestanden. \n- Een kwetsbaarheid in libxml2 kan leiden tot een out-of-bounds read en denial-of-service bij het verwerken van XML-input.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "WatchGuard heeft updates uitgebracht om de kwetsbaarheden in Fireware OS te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "Relative Path Traversal",
"title": "CWE-23"
},
{
"category": "general",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "general",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "general",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "general",
"text": "Improper Handling of Unicode Encoding",
"title": "CWE-176"
},
{
"category": "general",
"text": "Integer Underflow (Wrap or Wraparound)",
"title": "CWE-191"
},
{
"category": "general",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "general",
"text": "Improper Handling of Highly Compressed Data (Data Amplification)",
"title": "CWE-409"
},
{
"category": "general",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Inclusion of Functionality from Untrusted Control Sphere",
"title": "CWE-829"
},
{
"category": "general",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "general",
"text": "Incorrect Authorization",
"title": "CWE-863"
},
{
"category": "general",
"text": "Improper Validation of Specified Quantity in Input",
"title": "CWE-1284"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-13046"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-13224"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-13225/"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-18105"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-18145"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-18146/"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-81433"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-86101"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-86102/"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-86104"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-86105"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-86106/"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-86128"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-86131"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-86132"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-86133"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-86134"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-86135/"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-86136"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-86137/"
},
{
"category": "external",
"summary": "Reference",
"url": "https://psirt.watchguard.com/CVE-2026-90441"
}
],
"title": "Kwetsbaarheden verholpen in WatchGuard Fireware OS",
"tracking": {
"current_release_date": "2026-10-07T07:27:17.612003Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0404",
"initial_release_date": "2026-10-07T07:27:17.612003Z",
"revision_history": [
{
"date": "2026-10-07T07:27:17.612003Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Fireware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Fireware OS"
}
],
"category": "vendor",
"name": "WatchGuard"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-13046",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "description",
"text": "A vulnerability in WatchGuard Fireware OS\u0027s SAML single sign-on session handling allows attackers with file write access to execute arbitrary code by loading a malicious session file.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-13046 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13046.json"
}
],
"title": "CVE-2026-13046"
},
{
"cve": "CVE-2026-13224",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "other",
"text": "Relative Path Traversal",
"title": "CWE-23"
},
{
"category": "description",
"text": "A path traversal vulnerability in Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary local files via crafted management requests.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-13224 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13224.json"
}
],
"title": "CVE-2026-13224"
},
{
"cve": "CVE-2026-13225",
"cwe": {
"id": "CWE-80",
"name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"title": "CWE-80"
},
{
"category": "description",
"text": "A vulnerability in pretix allows malicious HTML injection into the email address field of an order, which is then rendered unsanitized on the individual ticket confirmation page.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-13225 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13225.json"
}
],
"title": "CVE-2026-13225"
},
{
"cve": "CVE-2026-18105",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "An uncontrolled resource consumption vulnerability in Fireware OS allows a low-privileged authenticated user to cause denial of service of diagnostic tools by repeatedly starting and aborting a crafted diagnostic task via the web UI.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-18105 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18105.json"
}
],
"title": "CVE-2026-18105"
},
{
"cve": "CVE-2026-18145",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "other",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "description",
"text": "A stack-based buffer overflow vulnerability in WatchGuard Fireware OS\u0027s spamBlocker (spamd) service allows an authenticated administrator to crash the service or potentially execute arbitrary code via a crafted management request.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-18145 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18145.json"
}
],
"title": "CVE-2026-18145"
},
{
"cve": "CVE-2026-18146",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "description",
"text": "The Fluent Forms WordPress plugin up to version 6.2.11 contains a Stored Cross-Site Scripting vulnerability via Notification Smartcode Values, enabling unauthenticated attackers to execute malicious scripts in the browsers of privileged users viewing form submission logs.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-18146 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18146.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-18146"
},
{
"cve": "CVE-2026-81433",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "other",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "other",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "A stack-based buffer overflow in WatchGuard Fireware OS\u0027s DHCP fingerprinting daemon allows unauthenticated adjacent attackers to execute arbitrary code or crash the process via crafted DHCP packets.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-81433 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-81433.json"
}
],
"title": "CVE-2026-81433"
},
{
"cve": "CVE-2026-86101",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"notes": [
{
"category": "other",
"text": "Incorrect Authorization",
"title": "CWE-863"
},
{
"category": "description",
"text": "A vulnerability in WatchGuard Fireware OS\u0027s SAML login enables an authenticated user with limited Access Portal rights to escalate privileges and gain unauthorized Mobile VPN with SSL access via a crafted request.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86101 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86101.json"
}
],
"title": "CVE-2026-86101"
},
{
"cve": "CVE-2026-86102",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "other",
"text": "Incorrect Authorization",
"title": "CWE-863"
},
{
"category": "description",
"text": "An OS command injection vulnerability in the WatchGuard AP internal API service allows attackers with network access to execute arbitrary shell commands on the device\u0027s operating system.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86102 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86102.json"
}
],
"title": "CVE-2026-86102"
},
{
"cve": "CVE-2026-86104",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Highly Compressed Data (Data Amplification)",
"title": "CWE-409"
},
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "A resource consumption vulnerability in Fireware OS\u0027s wgagent login process allows remote, unauthenticated attackers to cause denial of service by sending specially crafted requests.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86104 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86104.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86104"
},
{
"cve": "CVE-2026-86105",
"cwe": {
"id": "CWE-176",
"name": "Improper Handling of Unicode Encoding"
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Unicode Encoding",
"title": "CWE-176"
},
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "description",
"text": "An improper authorization vulnerability in Fireware OS\u0027s Access Portal reverse proxy enables authenticated low-privileged users to access unauthorized web applications by crafting specific requests for accessible resources.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86105 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86105.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86105"
},
{
"cve": "CVE-2026-86106",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"notes": [
{
"category": "other",
"text": "Missing Authentication for Critical Function",
"title": "CWE-306"
},
{
"category": "description",
"text": "A vulnerability in VeloCloud Edge HA allows unauthenticated actors with Layer 2 access to the private HA interconnect to trigger sensitive HA peer functions, potentially leading to elevated command execution without verification.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86106 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86106.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86106"
},
{
"cve": "CVE-2026-86128",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "description",
"text": "A NULL pointer dereference vulnerability in Fireware OS\u0027s NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause denial of service by sending a specially crafted IPv6 packet.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86128 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86128.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86128"
},
{
"cve": "CVE-2026-86131",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "other",
"text": "Inclusion of Functionality from Untrusted Control Sphere",
"title": "CWE-829"
},
{
"category": "other",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "description",
"text": "A code injection vulnerability in WatchGuard Fireware OS\u0027s BOVPN Over TLS client configuration enables a remote VPN server attacker to execute arbitrary root commands on the connecting Firebox device.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86131 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86131.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86131"
},
{
"cve": "CVE-2026-86132",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"notes": [
{
"category": "other",
"text": "Integer Underflow (Wrap or Wraparound)",
"title": "CWE-191"
},
{
"category": "description",
"text": "An integer underflow vulnerability in WatchGuard Fireware OS IKEv2 daemon allows remote unauthenticated attackers to crash the process via a crafted encrypted IKEv2 message using AES-GCM cipher suite.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86132 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86132.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86132"
},
{
"cve": "CVE-2026-86133",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Specified Quantity in Input",
"title": "CWE-1284"
},
{
"category": "other",
"text": "Integer Underflow (Wrap or Wraparound)",
"title": "CWE-191"
},
{
"category": "description",
"text": "An integer underflow vulnerability in WatchGuard Fireware OS IKE daemon allows remote attackers to crash the iked process and cause denial of service via a crafted encrypted IKEv2 message post-handshake.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86133 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86133.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86133"
},
{
"cve": "CVE-2026-86134",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "description",
"text": "A NULL pointer dereference vulnerability in WatchGuard Fireware OS\u0027s authentication process allows remote unauthenticated attackers to crash the management daemon via crafted login requests, resulting in denial of service.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86134 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86134.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86134"
},
{
"cve": "CVE-2026-86135",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"notes": [
{
"category": "other",
"text": "Cross-Site Request Forgery (CSRF)",
"title": "CWE-352"
},
{
"category": "description",
"text": "A CSRF vulnerability in WatchGuard Dimension allows remote attackers to trick authenticated administrators into creating unauthorized database snapshots via malicious web pages.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86135 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86135.json"
}
],
"title": "CVE-2026-86135"
},
{
"cve": "CVE-2026-86136",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "A missing authorization vulnerability in the wgagent management daemon enables an authenticated low-privileged user to crash the process and read arbitrary files via a specially crafted API request.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86136 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86136.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86136"
},
{
"cve": "CVE-2026-86137",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "description",
"text": "In libxml2 versions prior to 2.15.4, the xmlFAParsePosCharGroup function contains an out-of-bounds read vulnerability related to the NXT macro in xmlregexp, which can cause denial of service via specially crafted XML input.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86137 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86137.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.9,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86137"
},
{
"cve": "CVE-2026-90441",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "A missing authorization vulnerability in the wgagent management daemon enables an authenticated low-privileged user to crash the process and read arbitrary files via a specially crafted API request.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-90441 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90441.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-90441"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…