X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

Command Injection via Enterprise Configuration URLs in JetBrains Toolbox App

In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs

Code Execution via Project‑Controlled JVM Options in IntelliJ IDEA Safe Mode

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process

In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database

Code Execution via Unsafe Meson Project Settings in JetBrains CLion Safe Mode

In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings

JetBrains YouTrack Application Permission Bypass Allowing Privilege Escalation via Project Tab

In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab

Untrusted Remote Code Inclusion via Plugin Sandbox Page in JetBrains YouTrack

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page

SMTP Command Injection via Email Verification in JetBrains Hub

In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible

Privilege Escalation via Forged Email Verification in JetBrains Hub

In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible

Privilege Escalation via Email Authentication Flow in JetBrains Hub

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile

Visual Studio Spoofing Vulnerability

Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.

Permissive Cross‑Domain Policy in SonicOS Management Interface Allows Remote Unauthenticated Operations

A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.

Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

Openjpeg: denail of service via crafted image file

A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.

Kernel: netlink socket crash (null pointer deref) in netlink_dump function

A NULL pointer dereference vulnerability was found in netlink_dump. This issue can occur when the Netlink socket receives the message(sendmsg) for the XFRM_MSG_GETSA, XFRM_MSG_GETPOLICY type message, and the DUMP flag is set and can cause a denial of service or possibly another unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is unlikely.

Kernel: qxl: race condition leading to use-after-free in qxl_mode_dumb_create()

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.

Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer()

A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system.

Kernel: rsvp: out-of-bounds read in rsvp_classify()

A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service.

Samba: smb2 packet signing is not enforced when "server signing = required" is set

A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data.