CVE-2026-116778 FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

CVE-2026-116778 FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

EUVD-2026-112149

USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize in USB Test/src/driveinfo.cpp trusts DISKGEOMETRY.BytesPerSector returned by IOCTLDISKGETDRIVEGEOMETRY without checking wheth...

CVE-2026-47235

The SimulationCraft tool (versions after release-820-01 and before the May 7, 2026 nightly) is vulnerable to a Heap-Based Buffer Overflow and Out-of-Bounds Write in the bcp_api.cpp file. The root cause is a loop over the JSON sockets array that fails to bound gem_idx by MAX_GEM_SLOTS (four). This...

CVE-2026-47235 SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array

SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the bcpapi.cpp loop over the JSON sockets array uses slotdata"sockets".Size without bounding gemidx by MAXGEMSLOTS, which is four in...

EUVD-2026-112147

SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the bcpapi.cpp loop over the JSON sockets array uses slotdata"sockets".Size without bounding gemidx by MAXGEMSLOTS, which is four in...

CVE-2026-47235 SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array

SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the bcpapi.cpp loop over the JSON sockets array uses slotdata"sockets".Size without bounding gemidx by MAXGEMSLOTS, which is four in...

CVE-2026-93521

A heap buffer overflow exists in the X.Org X Server (versions before 2.1.25 ) and XWayland (versions before 24.4.14 ) within the RandR (Resize and Rotate extension) ChangeProviderProperty requests. The root cause is the incorrect calculation of buffer sizes and memory offsets when prepending or a...

EUVD-2026-112146

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context...

CVE-2026-93521 X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context...

CVE-2026-93521

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context...

CVE-2026-44179 XWiki Pro Macros: excerpt-include title and content injection executes code

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the excerpt-include macro does not properly escape the included page's title and executes excerpt content with the macro's rights. The title handling in...

CVE-2026-44179

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the "excerpt-include" macro does not properly escape the included page's title and executes "excerpt" content with the macro's rights. The title handling in...

CVE-2026-44179

The XWiki Pro Macros plugin (versions 1.13 until 1.14.5) contains a Remote Code Execution (RCE) vulnerability in the excerpt-include macro. The root cause is a failure to properly escape the included page's title in xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml, comb...

EUVD-2026-112144

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the excerpt-include macro does not properly escape the included page's title and executes excerpt content with the macro's rights. The title handling in...

EUVD-2026-112135

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context...

CVE-2026-93520 X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context...

CVE-2026-93520

The X.Org X server and XWayland are vulnerable to a heap buffer overflow due to mismatching size calculations between XkbAllocNames and ChangeKeycodeRange . Specifically, key name memory is allocated with an insufficient buffer size compared to the maximum supported range in the X Keyboard Extens...

CVE-2026-118375

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdmarecv function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack...

CVE-2026-93519

A heap-based buffer overflow exists in the X.Org X server (before 21.1.25) and XWayland (before 24.1.14) when handling pointer barriers in the XFIXES extension . The vulnerability is caused by the server writing pointer barrier events into a fixed-size buffer without proper boundary validation. A...