CVE-2022-26530

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

swaylock before 1.6 allows attackers to trigger a crash and achieve unlocked access to a Wayland compositor.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.redhat.com/show_bug.cgi?id=2066596Issue Tracking, Third Party Advisory
https://github.com/swaywm/swaylock/commit/1d1c75b6316d21933069a9d201f966d84099f6caPatch, Third Party Advisory
https://github.com/swaywm/swaylock/pull/219Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2066596Issue Tracking, Third Party Advisory
https://github.com/swaywm/swaylock/commit/1d1c75b6316d21933069a9d201f966d84099f6caPatch, Third Party Advisory
https://github.com/swaywm/swaylock/pull/219Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Apr 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-265317.8Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71 CVE-2022-265327.8A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLE CVE-2022-265336.1Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.CVE-2022-265347.5FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via a malicious viewchange packet, will cause normal CVE-2022-265369.8Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setFixTools.CVE-2022-26546.1The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before CVE-2022-265469.1Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensitive information and ob CVE-2022-26556.1The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an ad CVE-2022-265555.4A stored cross-site scripting (XSS) vulnerability in the Add a Button function of Eova v1.6.0 allows attackers to execute arbitrary web scri CVE-2022-26569.8A vulnerability classified as critical has been found in SourceCodester Multi Language Hotel Management Software. Affected is an unknown fun CVE-2022-265629.8An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if t CVE-2022-265638.8An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to improper PAM-authoriz