Critical vulnerabilities Week 2026-07-04

Critical Vulnerabilities pose a significant risk as they can be leveraged to carry out cyber attacks, install malware, steal sensitive data, or gain unauthorised access to systems. It's crucial for organisations and individuals to stay informed about the latest threats in order to assess their potential impact and take timely mitigating actions. If you need help with any of these, contact the HelpDesk for assistance. Cyber Security Services are also available.

X.Org Server CreateSaverWindow Use-After-Free Information Disclosure Vulnerability (5.5)

This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.5. The following CVEs are assigned: CVE-2026-50263.

Critical vulnerabilities Week 2026-07-04

X.Org Server CreateSaverWindow Use-After-Free Information Disclosure Vulnerability (5.5)

X.Org Server ChangeDrawableAttributes Out-Of-Bounds Read Information Disclosure Vulnerability (5.5)

X.Org Server SyncChangeCounter Use-After-Free Privilege Escalation Vulnerability (7.8)

X.Org Server FreeCounter Use-After-Free Privilege Escalation Vulnerability (7.8)

X.Org Server SetMap Request Stack-based Buffer Overflow Privilege Escalation Vulnerability (7.8)

X.Org Server Xkb Key Types Stack-based Buffer Overflow Privilege Escalation Vulnerability (7.8)

X.Org Server miSyncDestroyFence Use-After-Free Privilege Escalation Vulnerability (7.8)

X.Org Server Font Alias Stack-based Buffer Overflow Privilege Escalation Vulnerability (7.8)

Oracle PeopleSoft ExecuteProcessActivityCommand External Control of File Path Remote Code Execution Vulnerability (8.8)

Oracle PeopleSoft HubMBeanPersistance Deserialization of Untrusted Data Remote Code Execution Vulnerability (7.5)

Oracle PeopleSoft HttpListeningConnector Server-Side Request Forgery Vulnerability (9.3)

Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability (8.8)

Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability (8.8)

MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability (7.8)

ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability (7.2)

ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability (7.2)

ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability (7.2)

ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability (7.5)

ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability (5.5)

ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability (5.5)

Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability (8.8)

Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability (8.8)

Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability (8.8)

Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability (8.8)

Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability (8.8)

Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability (8.8)

Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability (8.8)

Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability (8.8)

Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability (8.8)

Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability (8.8)

Fuji Electric Tellus pcid64 Driver Registry APIs Exposed Dangerous Method Local Privilege Escalation Vulnerability (7.8)

Fuji Electric Tellus pcid64 Driver File APIs Exposed Dangerous Method Arbitrary File Deletion Vulnerability (7.8)

FlowiseAI Flowise CSV Agent customReadCSV Code Injection Remote Code Execution Vulnerability (8.8)

FlowiseAI Flowise CSV Agent Prompt Injection Remote Code Execution Vulnerability (9.8)

Docker MCP Plugin OCI Image Label Parsing Argument Injection Remote Code Execution Vulnerability (8.6)

Oracle VirtualBox VMSVGA Stack-based Buffer Overflow Local Privilege Escalation Vulnerability (7.5)

Adobe Acrobat Reader DC Field signatureInfo Use-After-Free Remote Code Execution Vulnerability (7.8)

MATE Desktop Atril Document Viewer EPUB File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (7.8)

Samsung rlottie Numeric Truncation Remote Code Execution Vulnerability (7.8)

Allegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability (4.6)

Allegra exportReport Directory Traversal Information Disclosure Vulnerability (6.5)

Apache HTTP Server mod_proxy_ajp Out-Of-Bounds Read Information Disclosure Vulnerability (3.7)

Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (7.8)

Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (7.8)

Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (7.8)

Adobe Acrobat Pro DC AcroForm Use-After-Free Remote Code Execution Vulnerability (7.8)

Adobe USD-Fileformat-plugins Heap-based Buffer Overflow Remote Code Execution Vulnerability (7.8)

Adobe USD-Fileformat-plugins Heap-based Buffer Overflow Remote Code Execution Vulnerability (7.8)

Adobe Acrobat Pro DC Annots.api Use-After-Free Remote Code Execution Vulnerability (7.8)

Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (7.8)

Adobe Acrobat Reader DC Multimedia Rendition Use-After-Free Remote Code Execution Vulnerability (7.8)

Adobe Acrobat Reader DC Annotation Use-After-Free Information Disclosure Vulnerability (3.3)

Adobe Acrobat Reader DC Font Handling Use-After-Free Remote Code Execution Vulnerability (7.8)

Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability (3.3)

Adobe Acrobat Reader DC TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (7.8)

Progress Software Kemp LoadMaster apiuser Uninitialized Memory Remote Code Execution Vulnerability (9.8)

Progress Software Kemp LoadMaster dolistapikeys Uninitialized Memory Remote Code Execution Vulnerability (7.2)

Progress Software Kemp LoadMaster dodelapikey Uninitialized Memory Remote Code Execution Vulnerability (8.8)

Microsoft Windows Narrator Braille Support brlapi Exposed Dangerous Function Local Privilege Escalation Vulnerability (7)

NVIDIA Transformers4Rec Model.load Deserialization of Untrusted Data Remote Code Execution Vulnerability (7.8)

X.Org Server CheckKeyTypes Buffer Overflow Privilege Escalation Vulnerability (7.8)

X.Org Server CheckKeyActions Out-Of-Bounds Read Information Disclosure Vulnerability (6.1)

X.Org Server SyncAwaitFence Use-After-Free Privilege Escalation Vulnerability (7.8)

X.Org Server CheckSetGeom Out-Of-Bounds Read Information Disclosure Vulnerability (6.1)

X.Org Server XkbSetCompatMap Integer Underflow Privilege Escalation Vulnerability (7.8)

QEMU calc_image_hostmem Integer Overflow Local Privilege Escalation Vulnerability (8.8)

(Pwn2Own) Microsoft Edge Feedback Log File Handling Directory Traversal Remote Code Execution Vulnerability (7.5)

(Pwn2Own) Microsoft Edge Navigation Handling Universal Cross-Site Scripting Vulnerability (5)

(Pwn2Own) Microsoft Edge Origin Validation Error Security Bypass Vulnerability (4.3)

ASUS MyASUS Origin Validation Error Local Privilege Escalation Vulnerability (7.8)

Docker Desktop grpcfuse Kernel Module Uncontrolled Recursion Denial-of-Service Vulnerability (6.5)

TrendAI Vision One Security Agent Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability (7.8)

TrendAI Vision One Security Agent Origin Validation Error Local Privilege Escalation Vulnerability (7.8)

TrendAI Vision One Security Agent Origin Validation Error Local Privilege Escalation Vulnerability (7.8)

TrendAI Vision One Security Agent Origin Validation Error Local Privilege Escalation Vulnerability (7.8)

TrendAI Vision One Security Agent Origin Validation Error Local Privilege Escalation Vulnerability (7.8)

TrendAI Vision One Security Agent Origin Validation Error Local Privilege Escalation Vulnerability (7.8)

TrendAI Vision One Security Agent Origin Validation Error Local Privilege Escalation Vulnerability (7.8)

Progress Software Kemp LoadMaster addcountry Command Injection Remote Code Execution Vulnerability (8.8)