CVE-2026-102813 is a vulnerability in the password-recovery functionality of the TP-Link RE305 V3 device. An unauthenticated attacker on the local network can trigger generation of an administrator password-reset verification code via a verification-code interface. This interface lacks effective attempt counters or lockout mechanisms and uses a predictable verification-code generation process, allowing brute-force or code prediction attacks. Successful exploitation enables the attacker to reset the administrator password and gain privileged device management access. A fix is available in version 1.1.8 Build 20260921 Rel. 42853.
CVE-2026-102812 is a vulnerability in TP-Link RE305 v3 and Archer C7 v5 devices where a hard-coded AES-128 cryptographic key and initialization vector are embedded in the firmware's configuration backup mechanism. This flaw allows an attacker who obtains a backup file to decrypt it and access sensitive configuration data such as administrator passwords and Wi-Fi credentials. The vulnerability has a medium severity with a CVSS 4.0 score of 6.9. Fixed versions 1.1.8 Build 20260921 Rel. 42853 and 1.3.1 Build 20260821 Rel. 41256 address this issue.
NextChat version 2.16.1 has a client-side cross-site scripting (XSS) vulnerability in its Plugin Editor. This flaw arises from unsafe rendering of externally supplied OpenAPI plugin schema content using React's dangerouslySetInnerHTML without proper sanitization. An attacker can host a malicious OpenAPI schema and trick a user into loading it, leading to arbitrary JavaScript execution within the NextChat application context. Exploitation could expose JavaScript-accessible cookies and other client-side data.
CVE-2026-108311 is a low-severity vulnerability in Tanium Server involving insufficient logging. This issue was addressed by Tanium in specific fixed versions. The vulnerability does not impact confidentiality or availability but may affect integrity due to limited logging capabilities. No known exploits are reported in the wild.
CVE-2026-108303 is a high-severity vulnerability in Tanium Certificate Manager that allows unauthorized code execution due to improper neutralization of special elements in commands, commonly known as command injection. The flaw affects versions 1.17 up to but not including 1.17.417, 1.18 up to but not including 1.18.368, and 1.22 up to but not including 1.22.119. Tanium has released fixed versions to address this issue.
An information disclosure vulnerability was identified and addressed in Tanium Server. The issue involves the generation of error messages that contain sensitive information. This vulnerability affects specific versions of Tanium Server prior to fixed releases. The CVSS score is 4.3, indicating a medium severity level.
CVE-2026-116656 is a high-severity vulnerability in Tanium Enforce that allows uncontrolled resource consumption. This flaw affects multiple versions prior to fixed releases and could lead to denial of service conditions. Tanium has addressed this issue in versions 2.9.736, 2.10.778, and 3.0.373.
CVE-2026-108325 is a vulnerability in Tanium Reputation that involves the insertion of sensitive information into log files. This flaw could lead to unauthorized disclosure of sensitive data through logs. Tanium has fixed this issue in versions 6.6.145, 6.7.138, and 6.8.162.
CVE-2026-116659 is a medium severity vulnerability in Tanium Enforce where the product allowed allocation of resources without limits or throttling, leading to uncontrolled resource consumption. This flaw was addressed by Tanium in versions 2.9.736, 2.10.778, and 3.0.373.
CVE-2026-108302 is an improper access control vulnerability in Tanium Comply that allows users with limited privileges to access resources they should not. The issue affects multiple versions prior to specific fixed releases. Tanium has addressed this vulnerability in versions 2.32.263, 2.35.323, and 2.37.326. The CVSS 3.1 base score is 4.3, indicating a medium severity impact with limited confidentiality impact and no integrity or availability impact.
CVE-2026-108306 is a local privilege escalation vulnerability in the Tanium Endpoint Configuration Toolset Solution affecting End-User Notifications. The flaw involves improper link resolution before file access, also known as 'link following'. This vulnerability has a high severity with a CVSS score of 7.8. Tanium has released fixed versions that address this issue.
CVE-2026-108329 is a high-severity vulnerability in Tanium Threat Response that allows unauthorized code execution due to improper neutralization of special elements in commands, commonly known as command injection. The flaw affects multiple versions prior to fixed releases. Tanium has addressed this issue in versions 4.9.476, 4.12.349, and 4.17.327.
CVE-2026-108332 is a vulnerability in the Tanium Endpoint Configuration Toolset Solution involving improper link resolution before file access in the Threat Response Client Extension. This flaw could allow an attacker with limited privileges to cause high impact on confidentiality and integrity. Tanium has released fixes for multiple affected versions.
CVE-2026-108301 is a vulnerability in Tanium Comply involving missing authorization controls that could allow improper access. The issue affects multiple versions prior to fixed releases. Tanium has addressed this vulnerability in versions 2.32.263, 2.35.323, and 2.37.326. The CVSS v3.1 score is 6.0, indicating a medium severity impact with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.
CVE-2026-108304 is a local privilege escalation vulnerability in the Tanium Endpoint Configuration Toolset Solution affecting End-User Notifications. The flaw involves improper link resolution before file access, also known as 'link following'. Tanium has addressed this vulnerability in multiple fixed versions. The vulnerability has a high severity with a CVSS score of 7.8.
CVE-2026-87086 is a denial of service vulnerability in Tanium Provision caused by an unchecked return value leading to a NULL pointer dereference. This flaw can cause the affected software to crash or become unavailable. Tanium has released fixes in versions 1.17.150, 1.23.161, and 1.24.199 to address this issue.
CVE-2026-108309 is a vulnerability in the Tanium Endpoint Configuration Toolset Solution's Performance Client Extension that allows uncontrolled resource consumption due to lack of limits or throttling. This can lead to denial of service conditions by exhausting system resources. Tanium has released fixes for multiple affected versions to address this issue.
CVE-2026-116658 is a denial of service vulnerability in Tanium Enforce caused by a NULL pointer dereference. It affects versions 2.9 up to but not including 2.9.736, 2.10 up to but not including 2.10.778, and 3.0 up to but not including 3.0.373. The vulnerability has been fixed in versions 2.9.736, 2.10.778, and 3.0.373. The CVSS v3.1 base score is 6.5, indicating a medium severity impact, with no confidentiality or integrity impact but a high impact on availability.
CVE-2026-108313 is a vulnerability in Tanium Server involving improper handling of case sensitivity that leads to incorrect privilege assignment. This flaw could allow an attacker with high privileges to gain unauthorized access or perform unauthorized actions. Tanium has addressed this issue in specific fixed versions.
CVE-2026-116649 is a high-severity vulnerability in Tanium Enforce involving improper neutralization of formula elements in CSV files. This flaw relates to insufficient output sanitization, which could allow an attacker to inject malicious formulas into CSV exports. Tanium has addressed this issue in versions 2.9.736, 2.10.778, and 3.0.373.