Search: 1.2.4.4

CVE-2026-103401 is a high-severity vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor. It involves improper link resolution before file access in unauthenticated web server handlers, allowing a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This affects Mist-managed routers and unmanaged routers not onboarded to a Conductor. Routers managed by Conductor are not vulnerable. Fixed versions are 7.0.5, 7.1.7, and 7.2.3.

CVE-2026-93536 is a heap-based buffer overflow vulnerability in X.Org X Server and XWayland caused by a use-after-free condition in the GestureBuildSprite() function. This flaw affects versions of X.Org X Server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit this vulnerability to crash the X server or potentially execute arbitrary code.

CVE-2026-93524 is a buffer over-read vulnerability in the CheckKeySyms() function of X.Org X Server and XWayland. It affects versions before 21.1.25 of X.Org X Server and before 24.1.14 of XWayland. Authenticated X clients could exploit this flaw to leak small amounts of memory information or potentially cause a server crash.

CVE-2026-93523 is a heap-based buffer overflow vulnerability in X.Org X Server and XWayland. It is triggered by a XIPassiveUngrabDevice request containing an out-of-range modifier value. This flaw affects versions of X.Org X Server before 21.1.25 and XWayland before 24.1.14. An authenticated X client could exploit this to crash the X server or potentially execute arbitrary code within the server context.

CVE-2026-93522 is a heap-based buffer overflow vulnerability in X.Org X Server and XWayland caused by mismatched size usage in the CopyArea CPU-to-FBO path. It affects X.Org X Server versions before 21.1.25 and XWayland versions before 24.1.14. Authenticated X clients could exploit this flaw to crash the X server or potentially execute arbitrary code within the server context. The vulnerability has a high severity rating with a CVSS score of 7.8. Fixed versions are 21.1.25 for X.Org X Server and 24.1.14 for XWayland.

CVE-2026-93521 is a heap-based buffer overflow vulnerability in the RandR ChangeProviderProperty requests of X.Org X Server and XWayland. It affects versions before 21.1.25 of X.Org X Server and before 24.1.14 of XWayland. Authenticated X clients could exploit this flaw to crash the X server or execute arbitrary code within its context.

A critical eval injection vulnerability (CWE-95) exists in the xwiki-pro-macros component of XWiki Remote Macros between versions 1.13 and 1.14.4. The `excerpt-include` macro improperly escapes included page titles and executes excerpt content with macro rights, allowing users with page edit permissions to inject executable macro syntax. This can lead to remote code execution affecting confidentiality, integrity, and availability of the entire XWiki installation. The issue is fixed in version 1.14.5.

An integer truncation vulnerability in the XkbResizeKeyType() function of X.org X server and XWayland allows authenticated X clients to trigger a heap buffer overflow. This flaw affects X.org X server versions before 21.1.25 and XWayland versions before 24.1.14. Exploitation could result in crashes or potentially arbitrary code execution within the X server process.

A heap buffer overflow vulnerability exists in the handling of the GLX RenderLarge request in X.org X server versions before 21.1.25 and XWayland versions before 24.1.14. This flaw occurs when the dataBytes value exceeds the cmdlen, and it can be triggered by an authenticated X client. Exploitation could lead to crashes or arbitrary code execution within the X server context.

A critical deserialization of untrusted data vulnerability (CWE-502) exists in Ultimate Member plugin versions up to 2.13.1. This flaw allows an attacker to perform object injection, potentially leading to full compromise of confidentiality, integrity, and availability.

Waline versions prior to 1.41.1 have a partial authentication bypass vulnerability in the login endpoint POST /api/token. The endpoint reads the email field from the request body without validating its type and passes it directly into a MongoDB query. If the email is a non-string JSON object, the query filter becomes empty and matches all users, causing the system to verify the password against the first user (the administrator). This allows attackers to bypass the email check for the administrator account, enabling user enumeration and credential-stuffing amplification. The issue is patched in version 1.41.1.

A use-after-free vulnerability exists in the present_clear_window_notifies() function in the X.org X Server versions before 21.1.25 and X Wayland versions before 24.1.14. This flaw could allow malicious X clients with limited privileges to crash the X server or potentially execute code within the server context.

A use-after-free vulnerability exists in X.org X Server before version 21.1.25 and XWayland before version 24.1.14 due to improper lifecycle management when adding or removing XInput master devices. Authenticated X clients could exploit this flaw to crash the X server, causing denial of service, or potentially execute code within the X server context.

A stored cross-site scripting (XSS) vulnerability exists in SliceWP versions up to 1.2.13 due to improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of other users. The flaw affects confidentiality, integrity, and availability of the affected system.

A critical SQL Injection vulnerability exists in Crowd Favorite DXP ToolKit up to version 2.0.1. This flaw allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The vulnerability has a high CVSS score of 9.3, indicating network exploitable with no privileges or user interaction required, and can cause high confidentiality impact and low availability impact.

A stored cross-site scripting (XSS) vulnerability exists in Crowd Favorite DXP ToolKit up to version 2.0.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts that execute in users' browsers. The vulnerability has a high severity score of 7.1 (CVSS 3.1) and affects confidentiality, integrity, and availability.

CVE-2026-93520 is a heap-based buffer overflow vulnerability in X.org X server and XWayland caused by mismatched size calculations between XkbAllocNames and ChangeKeycodeRange. It affects versions of X.org X server before 2.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit this flaw to crash the X server or potentially execute arbitrary code within its context.

CVE-2026-93519 is a heap-based buffer overflow vulnerability in the XFIXES extension handling of pointer barriers in X.Org X server versions before 21.1.25 and XWayland versions before 24.1.14. Authenticated X clients could exploit this flaw to crash the X server or potentially execute arbitrary code within the server context.