CVE-2026-111734

P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end of the receive buffer. This can cause a crash (denial of service) or disclose memory content.

• CWE-125

• https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf

Published

Oct 29, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111728Seanime v3.7.0 to v3.10.3 contains an argument injection vul…5.4
• CVE-2026-11173Out of bounds write in V8 in Google Chrome prior to 149.0.78…8.8
• CVE-2026-111730P-Net before 1.0.3 does not validate the LengthPeerStationNa…7.2
• CVE-2026-111731P-Net before 1.0.3 enters an infinite loop when handling a r…8.7
• CVE-2026-111732P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BL…9.3
• CVE-2026-111733P-Net before 1.0.3 dereferences a NULL AR pointer when handl…8.7
• CVE-2026-111735P-Net before 1.0.3 contains an integer underflow in pf_cpm_c…7.1
• CVE-2026-111736P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm…8.7
• CVE-2026-111737The Speed Optimizer WordPress plugin before 7.8.5 does not …3.5
• CVE-2026-111738The Speed Optimizer WordPress plugin before 7.8.5 does not …5.5
• CVE-2026-111739The Two Factor Authentication WordPress plugin before 1.17.0…7.5
• CVE-2026-11174Inappropriate implementation in Site Isolation in Google Chr…5.3