CVE-2026-118170 is a broken access control vulnerability in the strapi/review-workflows package of Strapi Open Source and Enterprise Headless CMS version 5.51.0. It allows unauthorized updates to documents without verifying the caller's update rights.
CVE-2026-57202 is a high-severity vulnerability in Asterisk prior to versions 20.20.1, 21.12.3, 22.10.1, 23.4.1 and certain Certified Asterisk releases. An authenticated attacker with read-only Asterisk REST Interface (ARI) credentials can exploit the setChannelVar function to perform write dialplan operations, including file writes, even when the 'live_dangerously' setting is disabled. The vulnerability requires the Asterisk HTTP server to be enabled and accessible, which is disabled by default and bound to localhost. This issue has been fixed in the stated versions.
CVE-2026-57188 is a high-severity stack buffer overflow vulnerability in the res_xmpp module of Asterisk, an open source telephony toolkit. It affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and certain Certified Asterisk releases. An authenticated attacker with an XMPP account on the same or federated server can exploit this by sending crafted packets to cause out-of-bounds writes. The vulnerability requires the res_xmpp module to be loaded and an XMPP connection configured. Fixed versions are available.
CVE-2026-116682 is a path traversal vulnerability in the FileBrowser Quantum web-based file manager. Before versions 1.5.2-stable and 2.0.1-beta, the backend improperly resolves symbolic links without verifying that the target remains within the user's authorized directory scope. This allows authenticated users with download access, and even unauthenticated users via public share links, to read files outside their assigned scope by exploiting reachable symlinks. The issue is fixed in versions 1.5.2-stable and 2.0.1-beta.
CVE-2026-117526 is a code injection vulnerability in reduxjs redux-devtools version 5.0.0. It affects the evalAction function of the Remotedev Server component. The vulnerability allows an attacker with local access to manipulate the action argument to inject code. Exploit code has been publicly disclosed. The project has been informed but has not yet responded or issued a fix.
HomeBox versions prior to 0.27.0 contain a server-side request forgery (SSRF) vulnerability due to improper handling of HTTP redirects in notifier URL validation. Authenticated users can exploit this by configuring notifier hosts that redirect to restricted internal addresses, bypassing SSRF protections. The issue affects immediate and scheduled notifier requests. It is fixed in version 0.27.0.
CVE-2026-88812 is a high-severity vulnerability in X.Org X Server and X Wayland involving a double free in the XKB SetGeometry function. This flaw affects versions of xorg-x11-server before 21.1.25 and X Wayland before 24.1.14. Exploitation could allow attached clients to cause a crash or potentially execute code within the X server context. The issue has been fixed in versions 21.1.25 and 24.1.14.
CVE-2026-102816 is an authorization vulnerability in the country or region configuration interface of the TP-Link RE305 v3 device. An unauthenticated attacker on the same local network can modify the wireless regulatory region settings, causing the device to reapply wireless configurations. Exploitation can disrupt wireless connections, cause channel unavailability, client disconnections, and wireless instability by applying parameters intended for different regulatory regions. The vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in firmware version 1.1.8 Build 20260921 Rel. 42853.
CVE-2026-102815 is an operating-system command injection vulnerability in the tmpServer service of TP-Link RE305 v3. The vulnerable service runs with root privileges and listens on the local loopback interface. A local attacker with low privileges on the device can exploit this flaw by submitting crafted requests to the TDDPv1 service, resulting in execution of arbitrary OS commands with root privileges. This vulnerability allows privilege escalation from a low-privileged process to root on the affected device.
CVE-2026-102814 is an OS command injection vulnerability in the TP-Link RE305 v3 device's TDDP v2 service. The service uses a fixed and derivable cryptographic key, allowing an unauthenticated attacker on the same local network to forge protocol packets and access privileged operations. This can lead to arbitrary system command execution with root privileges. The vulnerability affects version 0 and is fixed in version 1.1.8 Build 20260921 Rel. 42853. The CVSS 4.0 score is 8.7, indicating high severity.
CVE-2026-102813 is a vulnerability in the password-recovery functionality of the TP-Link RE305 V3 device. An unauthenticated attacker on the local network can trigger generation of an administrator password-reset verification code via a verification-code interface. This interface lacks effective attempt counters or lockout mechanisms and uses a predictable verification-code generation process, allowing brute-force or code prediction attacks. Successful exploitation enables the attacker to reset the administrator password and gain privileged device management access. A fix is available in version 1.1.8 Build 20260921 Rel. 42853.
CVE-2026-102812 is a vulnerability in TP-Link RE305 v3 and Archer C7 v5 devices where a hard-coded AES-128 cryptographic key and initialization vector are embedded in the firmware's configuration backup mechanism. This flaw allows an attacker who obtains a backup file to decrypt it and access sensitive configuration data such as administrator passwords and Wi-Fi credentials. The vulnerability has a medium severity with a CVSS 4.0 score of 6.9. Fixed versions 1.1.8 Build 20260921 Rel. 42853 and 1.3.1 Build 20260821 Rel. 41256 address this issue.
NextChat version 2.16.1 has a client-side cross-site scripting (XSS) vulnerability in its Plugin Editor. This flaw arises from unsafe rendering of externally supplied OpenAPI plugin schema content using React's dangerouslySetInnerHTML without proper sanitization. An attacker can host a malicious OpenAPI schema and trick a user into loading it, leading to arbitrary JavaScript execution within the NextChat application context. Exploitation could expose JavaScript-accessible cookies and other client-side data.
CVE-2026-108311 is a low-severity vulnerability in Tanium Server involving insufficient logging. This issue was addressed by Tanium in specific fixed versions. The vulnerability does not impact confidentiality or availability but may affect integrity due to limited logging capabilities. No known exploits are reported in the wild.
CVE-2026-108303 is a high-severity vulnerability in Tanium Certificate Manager that allows unauthorized code execution due to improper neutralization of special elements in commands, commonly known as command injection. The flaw affects versions 1.17 up to but not including 1.17.417, 1.18 up to but not including 1.18.368, and 1.22 up to but not including 1.22.119. Tanium has released fixed versions to address this issue.
An information disclosure vulnerability was identified and addressed in Tanium Server. The issue involves the generation of error messages that contain sensitive information. This vulnerability affects specific versions of Tanium Server prior to fixed releases. The CVSS score is 4.3, indicating a medium severity level.
CVE-2026-116656 is a high-severity vulnerability in Tanium Enforce that allows uncontrolled resource consumption. This flaw affects multiple versions prior to fixed releases and could lead to denial of service conditions. Tanium has addressed this issue in versions 2.9.736, 2.10.778, and 3.0.373.
CVE-2026-108325 is a vulnerability in Tanium Reputation that involves the insertion of sensitive information into log files. This flaw could lead to unauthorized disclosure of sensitive data through logs. Tanium has fixed this issue in versions 6.6.145, 6.7.138, and 6.8.162.
CVE-2026-116659 is a medium severity vulnerability in Tanium Enforce where the product allowed allocation of resources without limits or throttling, leading to uncontrolled resource consumption. This flaw was addressed by Tanium in versions 2.9.736, 2.10.778, and 3.0.373.
CVE-2026-108302 is an improper access control vulnerability in Tanium Comply that allows users with limited privileges to access resources they should not. The issue affects multiple versions prior to specific fixed releases. Tanium has addressed this vulnerability in versions 2.32.263, 2.35.323, and 2.37.326. The CVSS 3.1 base score is 4.3, indicating a medium severity impact with limited confidentiality impact and no integrity or availability impact.