Décio Brandão

**Name of the Vulnerable Software and Affected Versions** ppp (affected versions not specified) **Description** The `mp Enddisc()` function uses incorrect length calculations when formatting endpoint discriminator addresses for display. This flaw allows a received endpoint option to overflow a global result buffer, which could enable a malicious PPP peer to crash the `ppp(8)` process or potentially execute arbitrary code with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. (affected versions not specified) **Description** An issue exists where the `mp SetEnddisc()` function copies a user-supplied PSN endpoint value without performing length validation. This flaw allows a buffer overflow via the ppp(8) command interface, which a local user can exploit to crash ppp(8) or potentially execute arbitrary code with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TrueBooker – Appointment Booking and Scheduler System versions prior to 1.2.7 **Description** An authorization bypass exists due to the `admin user create cus` AJAX handler lacking authentication or capability checks. This allows unauthenticated attackers to pass a controlled `truebooker wp user id` parameter directly to the `wp update user()` function. By exploiting this, an attacker can overwrite the email address of any WordPress user, including administrators, and use the standard lost-password process to take full control of the account. **Recommendations** Update the plugin to a version later than 1.2.6. As a temporary mitigation, restrict access to the `admin user create cus` AJAX handler.