CWE-783 vulnerabilities

CVE-2026-7270 is a high-severity vulnerability in the FreeBSD kernel caused by an operator precedence logic error. This flaw leads to a buffer overflow condition where attacker-controlled data can overwrite adjacent execve(2) argument buffers. An unprivileged user may exploit this vulnerability to gain superuser privileges, posing a significant security risk. The affected versions include FreeBSD 15.0-RELEASE, 14.4-RELEASE, 14.3-RELEASE, and 13.5-RELEASE. No public exploits or patches are currently documented.

Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.

CVE-2026-25233 is a high-severity logic vulnerability in the PEAR pearweb system affecting versions prior to 1.33.0. The flaw is an operator precedence logic error in the roadmap role check, which allows non-lead maintainers to create, update, or delete roadmaps without proper authorization. This vulnerability does not require user interaction or elevated privileges beyond maintainer access and can be exploited remotely over the network. Although no known exploits are currently in the wild, the issue impacts the integrity of project management data within pearweb. The vulnerability has been patched in version 1.33.0, and organizations using affected versions should upgrade promptly. European organizations relying on PEAR components for PHP development or project management are at risk, especially those with active development teams using pearweb.