Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,568 stories synthesized.
A use-after-free bug in X.Org Server's SyncChangeCounter function (CVE-2026-50261, CVSS 7.8) lets local attackers escalate privileges to root on affected Linux systems.
A cross-site scripting flaw in the addclient3 component of Quest NetVault Backup (CVE-2026-9780) allows remote attackers to bypass authentication with a CVSS score of 8.8.
A critical SQL injection flaw in Quest NetVault Backup's NVBURASDevice component, tracked as CVE-2026-9781 with a CVSS score of 8.8, allows remote attackers to bypass authentication and execute arbitrary code.
A critical SQL injection flaw in Quest NetVault Backup's NVBUDeviceDrive component, tracked as CVE-2026-9782 with a CVSS score of 8.8, allows remote attackers to bypass authentication and execute arbitrary code.
A critical SQL injection flaw in Quest NetVault Backup's NVBULibraryPort component, tracked as CVE-2026-9784 with a CVSS score of 8.8, allows authenticated attackers to bypass authentication and execute arbitrary code.
A critical SQL injection flaw in Quest NetVault Backup's NVBULibrarySlot component, tracked as CVE-2026-9785 with a CVSS score of 8.8, allows authenticated attackers to bypass authentication and execute arbitrary code.
A command injection vulnerability in Quest NetVault Backup's NVBULogDaemon component, tracked as CVE-2026-9787 with a CVSS score of 8.8, allows authenticated attackers to bypass authentication and execute arbitrary code at the SYSTEM level.
A high-severity cross-site scripting vulnerability in Quest NetVault Backup's viewclient component allows remote attackers to bypass authentication and potentially execute code as SYSTEM.
A directory traversal vulnerability in ATEN Unizon, tracked as CVE-2026-9775 with a CVSS score of 5.5, allows authenticated remote attackers to delete arbitrary files via the uploadSSL function.
A directory traversal vulnerability in ATEN Unizon, tracked as CVE-2026-9776 with a CVSS score of 7.5, allows unauthenticated remote attackers to disclose sensitive information at the SYSTEM level.
A directory traversal vulnerability in ATEN Unizon, tracked as CVE-2026-9777 with a CVSS score of 7.2, allows authenticated remote attackers to execute arbitrary code at the SYSTEM level.
A stack-based buffer overflow in X.Org Server's font alias resolution, tracked as CVE-2026-50256 with a CVSS score of 7.8, allows local attackers to escalate privileges to root on affected Linux systems.
A critical stack-based buffer overflow in X.Org Server's Xkb Key Types handling, tracked as CVE-2026-50258, allows local attackers to escalate privileges to root on affected Linux systems.
A use-after-free bug in X.Org Server's miSyncDestroyFence function (CVE-2026-50257, CVSS 7.8) lets local attackers escalate privileges to root on affected Linux systems.
A new command injection flaw in Unraid's Web Server, tracked as CVE-2026-9773 with a CVSS score of 8.8, allows authenticated attackers to execute arbitrary code remotely.
A directory traversal vulnerability in ATEN Unizon, tracked as CVE-2026-9774 with a CVSS score of 5.5, allows authenticated remote attackers to delete arbitrary files via the updateLicense function.
A high-severity cryptographic signature verification flaw in ATEN Unizon, tracked as CVE-2026-9779 with a CVSS score of 7.2, allows authenticated remote attackers to execute arbitrary code at the SYSTEM level.
A use-after-free vulnerability in Adobe Acrobat Reader DC's Field signatureInfo component, tracked as CVE-2026-27278 with a CVSS score of 7.8, could allow remote attackers to execute arbitrary code by tricking users into opening a malicious file or visiting a malicious page.
A use-after-free vulnerability in X.Org Server's CreateSaverWindow function could allow local attackers to leak sensitive information after gaining low-privileged code execution.
A stack-based buffer overflow in the X.Org Server's SetMap request handler, tracked as CVE-2026-50259, allows local attackers to escalate privileges to root on affected Linux systems.
A high-severity command injection flaw in Unraid's Web Server FileUpload functionality, tracked as CVE-2026-9772, could let authenticated attackers execute arbitrary code on affected systems.
A use-after-free bug in X.Org Server's FreeCounter component (CVE-2026-50260, CVSS 7.8) lets local attackers escalate privileges to root on affected Linux systems.
A critical code injection vulnerability in FlowiseAI Flowise's CSV Agent customReadCSV function, tracked as CVE-2026-41137, allows authenticated attackers to execute arbitrary code remotely.
A critical prompt injection vulnerability in FlowiseAI's CSV Agent, tracked as CVE-2026-41264, allows unauthenticated attackers to achieve remote code execution with a CVSS score of 9.8.