An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.

CVE Database V5

Detailed information about CVE-2026-84941: CWE-611 Improper restriction of XML external entity reference in TP-Link Systems Inc. Omada Software Controller (Wind

CVE-2026-84941: CWE-611 Improper restriction of XML external entity reference in TP-Link Systems Inc. Omada Software Controller (Windows) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-84941: CWE-611 Improper restriction of XML external entity reference in TP-Link Systems Inc. Omada Software Controller (Windows)

A security researcher discovered an authentication bypass vulnerability in a YCombinator startup's platform that allowed unauthorized access to patient information, including personally identifiable information (PII) and protected health information (PHI). The vulnerability exposed API keys and tenant data behind an authentication guard. Attempts to responsibly disclose the issue to the startup's CEO were met with dismissal and blocking of the researcher. No patch or remediation information is provided.

The reported issue involves an authentication bypass vulnerability on a startup platform, which was supposed to be protected by an authentication guard. Exploiting this bypass allowed access to sensitive patient data, including PII and PHI, as well as API keys for all tenants. The conversation excerpt shows the CEO dismissing the researcher's findings. There is no technical detail about the nature of the bypass or any vendor advisory or patch information.

Reddit Cybersecurity

Detailed information about Average Conversation between Security Researcher and YCombinator Startup CEO. Get real-time updates, technical details, and mitigatio

Average Conversation between Security Researcher and YCombinator Startup CEO - Live Threat Intelligence - Threat Radar | OffSeq.com

Researcher: ...Using the API key, anyone is able to find information of the patients that includes their PII and PHI CEO: are you dumb? Researcher: What? Blocked Proof: <a href="https://imgur.com/Bul0d76">https://imgur.com/Bul0d76</a> Background: Found an authentication bypass on their platform which was behind auth guard, revealing information on all their tenants, along with the API keys. Excerpt above is the part of the real conversation when tried to bring the issue forward to the CEO. Posted on YCombinator subreddit as well.

Researcher: ...Using the API key, anyone is able to find information of the patients that includes their PII and PHI
 CEO: are you dumb?
 Researcher: What?
 Blocked
 Proof:
 https://imgur.com/Bul0d76
 Background: Found an authentication bypass on their platform which was behind auth guard, revealing information on all their tenants, along with the API keys. Excerpt above is the part of the real conversation when tried to bring the issue forward to the CEO.
 Posted on YCombinator subreddit as well.

Average Conversation between Security Researcher and YCombinator Startup CEO

Reddit Discussion: Average Conversation between Security Researcher and YCombinator Startup CEO

CVE-2026-17176 is an OS command injection vulnerability in the TDDP module of TP-Link Deco BE11000 V2. An adjacent network attacker can exploit this flaw by sending a crafted UDP packet to execute arbitrary commands with root privileges. Successful exploitation can lead to full device compromise, including unauthorized command execution and loss of confidentiality, integrity, and availability.

This vulnerability (CVE-2026-17176) involves improper neutralization of special elements used in an OS command (CWE-78) within the TDDP module of the Deco BE11000 V2 device by TP-Link Systems Inc. An attacker on an adjacent network can send a specially crafted UDP packet to trigger OS command injection, resulting in arbitrary command execution with root privileges. The CVSS 4.0 base score is 7.7, indicating high severity, with attack vector as adjacent network and no required privileges or user interaction. The vulnerability impacts device security by allowing complete compromise.

Detailed information about CVE-2026-17176: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in TP-Link Systems 

CVE-2026-17176: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in TP-Link Systems Inc. Deco BE11000 V2 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-17176: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in TP-Link Systems Inc. Deco BE11000 V2

endpoint-dlp

CVE-2026-16172 is an out-of-bounds heap read vulnerability in the Netskope Endpoint DLP (EPDLP) service. A local standard user can send a specially crafted message that bypasses bounds checking, potentially causing the kernel driver handler to crash. Exploitation may disrupt DLP enforcement temporarily and could disclose per-boot memory layout information to unauthorized users. The vulnerability affects versions prior to 141.0. The CVSS 4.0 score rates this as medium severity.

Netskope Endpoint DLP contains a CWE-125 out-of-bounds heap read vulnerability in its kernel driver handler. This occurs when a local standard user sends a crafted message that is not properly validated with a bounds check. Successful exploitation can crash the EPDLP service, interrupting data loss prevention enforcement, and may leak memory layout information for the current boot session. The vulnerability affects versions >=0 and <141.0 of the product. No known exploits are reported in the wild. The CVSS 4.0 vector is AV:L/AC:L/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:H, scoring 6.0 (medium).

Detailed information about CVE-2026-16172: CWE-125 Out-of-bounds read in Netskope Endpoint DLP affecting Netskope Endpoint DLP. Get real-time updates, technical

CVE-2026-16172: CWE-125 Out-of-bounds read in Netskope Endpoint DLP - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-16172: CWE-125 Out-of-bounds read in Netskope Endpoint DLP

CVE-2026-16174 is an integer overflow vulnerability in Netskope Endpoint DLP running on Windows. Exploitation requires the EPDLP module enabled and Memory Integrity disabled. A crafted message to the EPDLP process port can trigger memory corruption. This may lead to denial-of-service, arbitrary code execution, or privilege escalation locally. The vulnerability affects versions prior to 141.0. It has a high severity with a CVSS score of 8.7.

Netskope Endpoint DLP on Windows contains an integer overflow or wraparound vulnerability (CWE-190) that can be triggered by sending a crafted message to the EPDLP process port. This vulnerability requires the EPDLP module to be enabled and Memory Integrity to be disabled on the client. Successful exploitation can cause memory corruption, potentially resulting in denial-of-service, arbitrary code execution, or privilege escalation on the local machine. The issue affects versions from 0 up to but not including 141.0.

Detailed information about CVE-2026-16174: CWE-190 Integer overflow or wraparound in Netskope Endpoint DLP affecting Netskope Endpoint DLP. Get real-time update

CVE-2026-16174: CWE-190 Integer overflow or wraparound in Netskope Endpoint DLP - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-16174: CWE-190 Integer overflow or wraparound in Netskope Endpoint DLP

This CVE identifier was reserved for a potential vulnerability but was subsequently rejected by the assigning authority. No technical details, affected versions, or impact information have been provided, and no patch or mitigation information is available.

Detailed information about CVE-2025-71149. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-71149 has been rejected

Official rejection reason