CVE-2026-76682

An integer overflow vulnerability exists in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal. A remote, unauthenticated attacker can write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.

A missing authentication vulnerability exists in the Fireware OS FireCluster synchronization daemon. A remote, unauthenticated attacker can invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.

A stack-based buffer overflow vulnerability exists in Fireware OS's SIP proxy. A remote, unauthenticated attacker can execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.

A missing authentication vulnerability exists in FireCluster Sync processing. An attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, can invoke privileged firewall management actions as root by sending a specially crafted request.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Tribulant Software Newsletters (newsletters-lite). This issue affects Newsletters from n/a through 4.18.2.

A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service. An attacker who controls or intercepts traffic to the configured Active Directory server can create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.

A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service. An attacker who controls or intercepts traffic to the configured Active Directory server can create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.

A stack-based buffer overflow vulnerability exists in Fireware OS's WireGuard configuration processing. A remote attacker with man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud can create a denial of service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.

nest-admin before 1.0.1 contains an authentication bypass that lets unauthenticated attackers forge administrator tokens using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret trusted by JwtStrategy and RbacGuard, impersonating any user ID or claiming the admin role.

NVIDIA NeMo Agent Toolkit contains a missing authentication vulnerability that an attacker could exploit. This may lead to code execution, privilege escalation, data tampering, denial of service, and information disclosure.