Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-123784

Fluxbox through 1.3.7 OS Command Injection via Style Background Values

Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which are concatenated unescaped into an fbsetbg command run via $SHELL -c when the style loads.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Fluxbox-team
Products
Fluxbox
CVE-2026-123785

Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry

Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates, causing sustained CPU use and denial of service at startup.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Fluxbox-team
Products
Fluxbox