Search: 1.2.4.4

A stored cross-site scripting (XSS) vulnerability exists in SliceWP versions up to 1.2.13 due to improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of other users. The flaw affects confidentiality, integrity, and availability of the affected system.

A critical SQL Injection vulnerability exists in Crowd Favorite DXP ToolKit up to version 2.0.1. This flaw allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The vulnerability has a high CVSS score of 9.3, indicating network exploitable with no privileges or user interaction required, and can cause high confidentiality impact and low availability impact.

A stored cross-site scripting (XSS) vulnerability exists in Crowd Favorite DXP ToolKit up to version 2.0.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts that execute in users' browsers. The vulnerability has a high severity score of 7.1 (CVSS 3.1) and affects confidentiality, integrity, and availability.

CVE-2026-93520 is a heap-based buffer overflow vulnerability in X.org X server and XWayland caused by mismatched size calculations between XkbAllocNames and ChangeKeycodeRange. It affects versions of X.org X server before 2.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit this flaw to crash the X server or potentially execute arbitrary code within its context.

CVE-2026-93519 is a heap-based buffer overflow vulnerability in the XFIXES extension handling of pointer barriers in X.Org X server versions before 21.1.25 and XWayland versions before 24.1.14. Authenticated X clients could exploit this flaw to crash the X server or potentially execute arbitrary code within the server context.

CVE-2026-93518 is a heap-based buffer overflow vulnerability in X.org X server and XWayland caused by an integer truncation issue in the XkbResizeKeyType() function. It affects authenticated X clients on versions before 21.1.25 for X.org X server and before 24.1.14 for XWayland. Exploitation could lead to crashes or potential code execution within the X server.

CVE-2026-116078 is a resource exhaustion vulnerability in the HTTP/2 request body reader of mtrudel bandit. An unauthenticated remote attacker can exhaust server memory by sending a request body composed of many 1-byte DATA frames. This occurs because each 1-byte DATA frame is stored as a separate list element, causing excessive memory use. The issue affects bandit versions from 0.3.1 up to but not including 1.14.1. The vulnerability is fixed in version 1.14.1.

CVE-2026-93517 is a heap-based buffer overflow vulnerability in the X.org X server and XWayland. It occurs in the handling of the GLX RenderLarge request when dataBytes exceeds cmdlen. This flaw affects versions of X.org X server before 21.1.25 and XWayland before 24.1.14. An authenticated X client can trigger this vulnerability, potentially causing crashes or arbitrary code execution within the X server context.

Three TLS vulnerabilities were disclosed in the GoAhead web server used in hundreds of millions of devices across IoT, OT, firewall, and military sectors. The critical flaw (CVE-2026-115881) affects versions 3.4.5 through 6.1.0 built with OpenSSL or compatible libraries configured for mutual TLS with certificate revocation lists, allowing revoked certificates to be accepted. Another flaw affects versions 4.0.2 through 6.1.0 built with Mbed TLS, weakening encryption of some TLS 1.2 connections and enabling offline decryption of recorded sessions if clients accept flawed parameters. A third flaw (CVE-2026-115884) impacts versions up to 6.1.0 built with LibreSSL 3.2.x or 3.3.2 through 3.3.6, bypassing certificate chain length limits under certain configurations. GoAhead 6.1.1 fixes the OpenSSL and Mbed TLS issues, and mitigations exist for the LibreSSL issue. The availability of upstream fixes does not guarantee device patches, which depend on manufacturers.

CVE-2026-59176 affects the functype TypeScript functional programming libraries prior to version 1.4.4. The vulnerability arises from the MCP tool `set_functype_version` accepting an unconstrained version string that can include package-alias syntaxes, allowing arbitrary local or remote packages to be installed and executed with MCP server privileges. This can lead to execution of attacker-controlled JavaScript code. The flaw is exploitable by any MCP client invoking the tool, which is enabled by default without authentication in stdio mode, and potentially by a connected AI assistant vulnerable to indirect prompt injection. The issue is fixed in version 1.4.4.

CVE-2026-93516 is a use-after-free vulnerability in X.org X Server and XWayland caused by improper lifecycle management when adding or removing XInput master devices. It affects versions of X.org X Server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit this flaw to crash the X server or potentially execute code within the X server context. The vulnerability has a medium severity rating with a CVSS score of 5.5. Fixes are available in versions 21.1.25 for X.org X Server and 24.1.14 for XWayland.

Waline versions prior to 1.41.1 have an improper authentication vulnerability in the login endpoint where the email field is not properly validated. This allows an attacker to bypass the email check by submitting a non-string email value, causing the system to authenticate against the first user (the administrator) if the password is correct. The vulnerability enables partial authentication bypass, user enumeration, and credential-stuffing amplification. The issue is fixed in version 1.41.1.

CVE-2026-93515 is a use-after-free vulnerability in the present_clear_window_notifies() function of the X.org X Server before version 21.1.25 and X Wayland before version 24.1.14. This flaw could allow malicious X clients with limited privileges to crash the X server or potentially execute code within the server context. The vulnerability has a medium severity rating with a CVSS score of 6.8. Fixed versions are 21.1.25 for X.org X Server and 24.1.14 for X Wayland.

A stored cross-site scripting (XSS) vulnerability exists in the Joomla extension iCagenda versions 3.2.1 through 4.0.16. The flaw is triggered via the url-type event Custom Field, allowing malicious scripts to be stored and potentially executed in users' browsers.

Dell iDRAC Service Module (iSM) versions prior to 6.1.1.0 for Windows, Linux, and ESXi contain a code injection vulnerability. This flaw allows a high privileged local attacker to potentially elevate their privileges. The vulnerability is identified as improper control of code generation (CWE-94). The CVSS score is 4.2, indicating a medium severity level. No patch or remediation details are provided in the available data.

A missing authorization vulnerability exists in the wphocus My auctions allegro my-auctions-allegro-free-edition plugin, affecting versions up to 4.0.3. This flaw allows attackers with limited privileges to bypass access controls, potentially leading to unauthorized information disclosure or modification. The vulnerability is identified as CWE-862 and has a CVSS v3.1 base score of 5.4 (medium severity). No patch or official remediation has been indicated in the available data.

A divide-by-zero vulnerability was identified and resolved in the Linux kernel's IPv4 fib_rebalance function. The issue occurs when concurrent changes cause the first pass of nexthop weight calculation to return zero, while the second pass still sees eligible nexthops, leading to division by zero. The fix sets nexthop upper bounds to -1 when the total is zero, avoiding the division and aligning with a similar IPv6 fix.