Tagged “cve.org”
CVEs tagged cve.org, newest first.
38072 CVEsRSS
CVE-2026-108332Medium· 6.3Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.
Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.
CVE-2026-108301Medium· 6.0Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-102812Medium· 6.9Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7
A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management comp…
CVE-2026-108306High· 7.8Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
CVE-2026-108302Medium· 4.3Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-108325Medium· 6.6Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.
Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.
CVE-2026-116659Medium· 4.3Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
CVE-2026-116656High· 7.5Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
CVE-2026-108316Medium· 4.3Tanium addressed an information disclosure vulnerability in Tanium Server.
Tanium addressed an information disclosure vulnerability in Tanium Server.
CVE-2026-108303High· 8.8Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.
Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.
CVE-2026-108311Low· 2.7Tanium addressed an insufficient logging vulnerability in Tanium Server.
Tanium addressed an insufficient logging vulnerability in Tanium Server.
CVE-2026-118132NoneCVE-2026-118132
NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, …
CVE-2026-102814High· 8.7Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets a…
CVE-2026-102816Medium· 5.3Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305
An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply i…
CVE-2026-117526Medium· 5.3reduxjs redux-devtools Remotedev Server evalAction code injection
A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only…
CVE-2026-116680Medium· 6.4Homebox generic notifier SSRF via HTTP redirect after URL validation
HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request throu…
CVE-2026-102813Medium· 6.1Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-res…
CVE-2026-102815Medium· 6.9Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged …
CVE-2026-116682High· 8.6FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the…
CVE-2026-88812High· 7.8X.Org Server XKB SetGeometry TextDoodad Double Free
A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.
CVE-2026-104349High· 7.3Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427)
Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu…
CVE-2026-48380Medium· 5.5Substance3D - Painter | Out-of-bounds Read (CWE-125)
Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requi…
CVE-2026-48379High· 7.8Substance3D - Painter | Stack-based Buffer Overflow (CWE-121)
Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
CVE-2026-117512High· 7.3oretnom23 php-travel-agency-system employee_insert.php unrestricted upload
A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is p…
CVE-2026-109088Medium· 6.5libXtst RECORD EnableContext Reply Endless Loop
A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.
CVE-2026-116672High· 8.8Authlib RFC 7592 examples omit registration-access-token client binding
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations l…
CVE-2026-57185Medium· 6.5Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer o…
CVE-2026-109090High· 7.5libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
CVE-2026-57197High· 7.7Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg…
CVE-2026-108014Critical· 9.1eMudhra Compromised Certificate vulnerability impacts HCL Domino Server
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server. An unauthenticated n…