Tagged “cve.org”
CVEs tagged cve.org, newest first.
47231 CVEsRSS
CVE-2026-108306High· 7.8Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
CVE-2026-108302Medium· 4.3Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-108325Medium· 6.6Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.
Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.
CVE-2026-116659Medium· 4.3Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
CVE-2026-116656High· 7.5Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
CVE-2026-108316Medium· 4.3Tanium addressed an information disclosure vulnerability in Tanium Server.
Tanium addressed an information disclosure vulnerability in Tanium Server.
CVE-2026-108303High· 8.8Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.
Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.
CVE-2026-108311Low· 2.7Tanium addressed an insufficient logging vulnerability in Tanium Server.
Tanium addressed an insufficient logging vulnerability in Tanium Server.
CVE-2026-118132Medium· 6.1CVE-2026-118132
NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, …
CVE-2026-102814High· 8.7Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets a…
CVE-2026-102816Medium· 5.3Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305
An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply i…
CVE-2026-117526Medium· 5.3PoCreduxjs redux-devtools Remotedev Server evalAction code injection
A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only…
CVE-2026-116680Medium· 6.4Homebox generic notifier SSRF via HTTP redirect after URL validation
HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request throu…
CVE-2026-102813Medium· 6.1Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-res…
CVE-2026-102815Medium· 6.9Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged …
CVE-2026-116682High· 8.6PoCFileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory
FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory
CVE-2026-88812High· 7.8X.Org Server XKB SetGeometry TextDoodad Double Free
A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.
CVE-2026-104349High· 7.3Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427)
Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu…
CVE-2026-48380Medium· 5.5Substance3D - Painter | Out-of-bounds Read (CWE-125)
Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requi…
CVE-2026-48379High· 7.8Substance3D - Painter | Stack-based Buffer Overflow (CWE-121)
Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
CVE-2026-117512High· 7.3PoCoretnom23 php-travel-agency-system employee_insert.php unrestricted upload
A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is p…
CVE-2026-109088Medium· 6.5libXtst RECORD EnableContext Reply Endless Loop
A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.
CVE-2026-57185Medium· 6.5Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer o…
CVE-2026-109090High· 7.5libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
CVE-2026-57197High· 7.7Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg…
CVE-2026-108014Critical· 9.1eMudhra Compromised Certificate vulnerability impacts HCL Domino Server
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server. An unauthenticated n…
CVE-2026-48360Critical· 9.6Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to exe…
CVE-2026-117513High· 7.3PoCoretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection
A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer_search.php of the component Admin Search Pages. Executing a manipulation of the argument customer_na…
CVE-2026-116675High· 8.5TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malic…
CVE-2026-116674Medium· 6.5PoCsysteminformation: Prototype pollution in `networkStats()` via the interface name
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it wi…