CVE-2026-93536 is a use-after-free vulnerability in the GestureBuildSprite component of the X.Org Server version 3.0. The vulnerability has been publicly disclosed but lacks detailed technical information and a CVSS score. No known exploits in the wild or patches are currently documented.
CVE-2026-93524 is an out-of-bounds read vulnerability in the X.Org Server related to XKB SetMap key width and action count desynchronization. This flaw involves improper handling of key width and action count data, potentially leading to memory access issues.
CVE-2026-93523 is an out-of-bounds write vulnerability in the X.Org Server's XInput2 PassiveUngrabDevice functionality. This vulnerability could allow an attacker to write outside the intended memory bounds, potentially leading to memory corruption.
CVE-2026-93521 is a heap buffer overflow vulnerability in the X.Org Server's RandR ChangeProviderProperty functionality affecting version 3.0. The vulnerability is categorized under CWE-122, indicating a heap-based buffer overflow issue. No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild. No patch or remediation information is currently available.
CVE-2026-93520 is a heap out-of-bounds write vulnerability in the X.Org Server component related to the XKB ChangeKeycodeRange functionality. This flaw could potentially lead to memory corruption. No CVSS score or detailed impact information is provided. The affected version is exactly 3.0. No public exploit or patch information is currently available.
CVE-2026-93519 is a buffer overflow vulnerability in the X.Org Server's XFixes Pointer Barrier Event List component affecting version 3.0. The vulnerability is identified as a heap-based buffer overflow (CWE-122). No CVSS score or detailed impact information is provided. There is no indication of known exploitation in the wild or available patches.
CVE-2026-93518 is a vulnerability in the X.Org Server related to the XKB ResizeKeyType that involves numeric truncation. The vulnerability is identified with CWE-122, which typically relates to a heap-based buffer overflow or similar memory corruption issues. The affected version explicitly stated is version 3.0. No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild.
CVE-2026-93517 is a heap buffer overflow vulnerability in the GLX RenderLarge component of the X.Org Server, specifically affecting version 3.0. The vulnerability is categorized under CWE-122, indicating a classic heap-based buffer overflow issue. No CVSS score or detailed impact information is provided, and there are no known exploits in the wild. No patch or remediation information is available from the vendor at this time.
CVE-2026-93516 is a use-after-free vulnerability in the .Org Server XInput Passive Grab component of Microsoft software version 3.0. The vulnerability is publicly disclosed but lacks detailed technical or impact information and no CVSS score is provided.
CVE-2026-93515 is a use-after-free vulnerability in the .Org Server Present Extension affecting Microsoft product version 3.0. The vulnerability is publicly known but lacks detailed technical or impact information and has no CVSS score assigned.
CVE-2026-92709 is a vulnerability in Rsyslog version 3.0 involving a path traversal flaw in DynFile that allows arbitrary file write as root, potentially leading to remote code execution (RCE).
Red Hat has released a security update for the java-21-openjdk packages in Red Hat Enterprise Linux 8 and 9. This update addresses multiple security vulnerabilities across various components of the OpenJDK 21 Java Runtime Environment and Software Development Kit, including enhancements to PKCS5 padding, TLS certificate handling, LDAP logins, SASL authentication, HTTP client and server handling, XML processing, and more. The update is rated as Important by Red Hat Product Security. Users should apply this update to mitigate the addressed vulnerabilities.
CVE-2026-107238 is a high-severity vulnerability in the Veeam Management Pack for Microsoft System Center Collector service that allows an authenticated domain user to execute code remotely with LocalSystem privileges on affected servers. This vulnerability enables privilege escalation to the highest system level, potentially compromising the entire server. No specific affected versions or patch information is provided in the available data.
CVE-2026-92744 is a high-severity vulnerability in a privilege manager agent that under certain conditions allows a remote unauthenticated attacker to execute arbitrary code with LocalSystem privileges. The vulnerability has a CVSS 4.0 base score of 8.7, indicating significant impact. No affected versions or patch information are provided, and no known exploits are reported in the wild.
This vulnerability allows a member of the Veeam Virtualization Extensions Users group to execute remote code on servers running the Veeam Management Pack for Microsoft System Center Collector service. It is identified as CVE-2026-107239 with a high severity score of 8.8. The vulnerability involves a path traversal issue (CWE-23) that could lead to remote code execution. No affected versions or patch information are provided, and there are no known exploits in the wild at this time.
An authenticated, low-privileged Nessus user on Linux with scan-creation rights can read arbitrary text files on the scanner host by running a custom Unix compliance audit. This allows reading files with the privileges of the nessusd process without requiring higher privileges or user interaction.
Spreadsheet::XLSX versions before 0.19 for Perl contain a vulnerability that allows arbitrary code execution. The flaw arises from the use of string eval on number format conditions in ExcelFmt during workbook parsing. An attacker can craft a malicious XLSX file with a specially formatted number condition to execute arbitrary Perl code when the file is processed.
Tornado's RedirectHandler in versions >=2.2.0 <2.2.2_7 allows open redirect vulnerabilities when URL templates include substitutions that can alter the scheme or host of the redirect target. This can enable attackers to craft URLs that redirect users to arbitrary external sites, facilitating phishing attacks. The issue is fixed in version 2.2.2_7 by rejecting substitutions that change the scheme or host.
Tornado HTTP servers have a vulnerability in their header parser that causes quadratic CPU usage when parsing HTTP headers with obsolete line folding (line continuation with leading whitespace). An unauthenticated attacker can exploit this by sending specially crafted requests with many folded header lines, causing the server's event loop to block and degrade availability. The issue affects all Tornado HTTP servers before version 6.6. The vulnerability is fixed in Tornado 6.6 by removing support for obsolete line folding and rejecting header lines starting with whitespace.
Tornado HTTP servers are vulnerable to event loop blocking and excessive memory use when processing HTTP/1.1 chunked transfer encoding bodies composed of many small chunks. An attacker can send a request body with millions of 1-byte chunks, causing the event loop to block for extended periods (up to a minute for ~100 MB bodies) and consuming significantly more memory than the actual body size. This affects all Tornado HTTP servers that read request bodies without early rejection and also affects the SimpleAsyncHTTPClient when reading responses. The issue is fixed in Tornado 6.6 with changes to yield to the event loop periodically and optimize chunk handling.