CVE-2026-55706

HighCVSS 8.3/10Last modified Jul 13, 2026

Description

sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1284

Affected software

No affected versions have been published.

Timeline

Published
Jun 17, 2026
Last modified
Jul 13, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-557077.1In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user canCVE-2026-557083.1In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a CVE-2026-55717.5A vulnerability was identified in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The impacted element is an unknown function of the file /fs CVE-2026-557175.9In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'reCVE-2026-55724.3A security flaw has been discovered in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. This affects an unknown function. Performing a manipulaCVE-2026-557219.3Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The coCVE-2026-557238.3When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability existCVE-2026-557265.3The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to CVE-2026-557277.5A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow anCVE-2026-557283.8Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI,CVE-2026-557297.7Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 before 5.0.8 on all platforms allows an unaCVE-2026-55739.8A weakness has been identified in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. This impacts an unknown function of the file /fs. Executing
CVE-2026-55706: High severity, CVSS 8.3 | Vulnix