Tagged “cve.org”
CVEs tagged cve.org, newest first.
46471 CVEsRSS
CVE-2026-116668Medium· 4.3Tanium addressed an uncontrolled resource consumption vulnerability in Discover.
Tanium addressed an uncontrolled resource consumption vulnerability in Discover.
CVE-2026-116661Medium· 6.5Tanium addressed an improper access controls vulnerability in Enforce.
Tanium addressed an improper access controls vulnerability in Enforce.
CVE-2026-116667Medium· 4.2Tanium addressed an improper access controls vulnerability in Discover.
Tanium addressed an improper access controls vulnerability in Discover.
CVE-2026-116664Low· 3.1Tanium addressed an improper access controls vulnerability in Discover.
Tanium addressed an improper access controls vulnerability in Discover.
CVE-2026-116669Medium· 6.5Tanium addressed an improper access controls vulnerability in Discover.
Tanium addressed an improper access controls vulnerability in Discover.
CVE-2026-116665Medium· 4.3Tanium addressed an information disclosure vulnerability in Discover.
Tanium addressed an information disclosure vulnerability in Discover.
CVE-2026-108324Medium· 6.5Tanium addressed a denial of service vulnerability in Tanium Client.
Tanium addressed a denial of service vulnerability in Tanium Client.
CVE-2026-108327Medium· 5.0Tanium addressed a path traversal vulnerability in Tanium Data Service.
Tanium addressed a path traversal vulnerability in Tanium Data Service.
CVE-2026-116654Medium· 6.5Tanium addressed an improper input validation vulnerability in Threat Response.
Tanium addressed an improper input validation vulnerability in Threat Response.
CVE-2026-116652Medium· 4.3Tanium addressed a business logic error in Threat Response.
Tanium addressed a business logic error in Threat Response.
CVE-2026-116653Medium· 4.3Tanium addressed an improper input validation vulnerability in Threat Response.
Tanium addressed an improper input validation vulnerability in Threat Response.
CVE-2026-116651High· 7.5Tanium addressed an unauthorized code execution vulnerability in Threat Response.
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
CVE-2026-116646Medium· 4.3Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response.
Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response.
CVE-2026-121520Medium· 4.5Malicious client could set xattr value outside of BuildKit state directory
In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trus…
CVE-2026-121522Medium· 6.7Possible panic from Git source resolver
In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The is…
CVE-2026-121541Medium· 5.6Bake filesystem path entitlements approval can be skipped in some multi-target builds
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, files…
CVE-2026-115541High· 7.2HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation
HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated use…
CVE-2026-121614High· 7.1Docker Sandboxes host Git executes repository-controlled programs
Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a…
CVE-2026-63501High· 7.5PoCag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)
ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit prop…
CVE-2026-38600Critical· 9.8PoCA Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.
A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.
CVE-2026-63395High· 8.8PoCisomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious r…
CVE-2026-61497Medium· 5.2TinyUSB < 0.20.1 Integer Underflow via HID Report Descriptor Parser
TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read …
CVE-2026-88968High· 7.7Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code ru…
CVE-2026-63475Medium· 4.3PoCisomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the …
CVE-2026-82158Critical· 9.0Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability
Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exp…
CVE-2026-121086Critical· 9.6Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page
Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-121514Medium· 6.3EasySoft ZenTao PMS User model.php checkGroupChange privileges management
A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improp…
CVE-2026-115779Medium· 6.3Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and pat…
CVE-2026-121090High· 8.3Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML…
Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML…
CVE-2026-121253NoneMissing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low)