CVE-2026-113719 is a vulnerability in virtualenv's app-data seeder where the removal of previously installed seed packages does not properly validate deletion paths. This allows deletion of files outside the intended environment if malicious distribution metadata is present. The flaw occurs during environment creation when reusing an existing environment containing manipulated package metadata. The issue was introduced in version 20.8.1 and fixed in versions 1.6.2 and 1.18.1_2 of the affected product. Exploitation requires attacker-controlled metadata and deletion rights by the invoking user. The CVSS score is 4.5 (medium severity).
A vulnerability in filelock versions 4.1.0 through 4.2.0 allows a local unprivileged user to exploit a race condition in the soft-lock stale break restore process. This occurs when the user can write to a shared lock directory without the sticky bit, replacing a lock file marker with a symbolic link. The lock user's process then creates a hard link to one of its own files via the symbolic link, exposing file metadata and allowing the other user to manipulate the file's name. On version 4.2.0, this can lead to truncation of the lock user's file. The vulnerability requires specific conditions including a writable non-sticky directory and CPython 3.12 or later on Linux or macOS. The CVSS 3.1 score is 5.3 (Medium). A fix is available in version 1.18.4 for the related product pipx.
undici's WebSocket client, including Node.js's bundled globalThis.WebSocket, is vulnerable to a denial of service condition caused by unbounded automatic PONG buffering. A malicious WebSocket server can send continuous PING frames causing the client to queue PONG responses without respecting backpressure, leading to memory exhaustion and process termination. This affects undici versions from 5.15.0 up to but not including 6.29.1, 7.0.0 up to 7.30.1, and 8.0.0 up to 8.12.2. Upgrading to versions 6.29.1, 7.30.1, or 8.12.2 mitigates the issue by properly handling backpressure.
A denial of service vulnerability exists in go-jose when parsing JWKs containing RSA keys with crafted parameters. The vulnerability arises because go-jose does not validate bounds on RSA modulus and primes before calling crypto/rsa.PrivateKey.Validate(), which on Go 1.24+ has cubic time complexity relative to key size. This allows an attacker to supply a malicious JWK that causes excessive CPU consumption during parsing. The issue affects go-jose versions prior to 4.1.6 and 3.0.5 and has been fixed in version 4.1.6.
A denial of service vulnerability has been identified and addressed in Tanium Server. The vulnerability could allow an unauthenticated attacker to cause a denial of service condition, impacting availability. The issue is tracked as CVE-2026-108310 with a medium severity rating and a CVSS score of 5.3.
The CTFer.io Terraform Provider for CTFd versions from 0.1.5 up to but not including 2.8.2 stores the ctfd_team.password value in Terraform state as a non-sensitive value. This means that anyone with access to the Terraform state file can read team passwords without needing additional decryption. The vulnerability is fixed in version 2.8.2.
CVE-2026-102816 is an authorization vulnerability in the country or region configuration interface of the TP-Link RE305 v3 device. An unauthenticated attacker on the same local network can modify the wireless regulatory region settings, causing the device to reapply wireless configurations. Exploitation can disrupt wireless connections, cause channel unavailability, client disconnections, and wireless instability by applying parameters intended for different regulatory regions. The vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in firmware version 1.1.8 Build 20260921 Rel. 42853.
CVE-2026-116658 is a denial of service vulnerability in Tanium Enforce caused by a NULL pointer dereference. It affects versions 2.9 up to but not including 2.9.736, 2.10 up to but not including 2.10.778, and 3.0 up to but not including 3.0.373. The vulnerability has been fixed in versions 2.9.736, 2.10.778, and 3.0.373. The CVSS v3.1 base score is 6.5, indicating a medium severity impact, with no confidentiality or integrity impact but a high impact on availability.
CVE-2026-108326 is an improper certificate validation vulnerability in the Tanium Endpoint Configuration Toolset Solution's Stream Client Extension. This flaw could allow an attacker to exploit the certificate validation process. Tanium has released fixes for multiple affected versions to address this issue. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room member who establishes a WebRTC connection can send mouse and keyboard events through the legacy control channel while controls are locked or the member is otherwise unauthorized by the modern control API. This issue is fixed in version 3.1.5.
CVE-2026-87085 is a SQL injection vulnerability in Tanium Provision that allows improper neutralization of special elements used in SQL commands. This flaw was addressed by Tanium in versions 1.17.150, 1.23.161, and 1.24.199. The vulnerability has a medium severity with a CVSS score of 6.5, indicating it requires low privileges to exploit and can impact confidentiality, integrity, and availability to a limited extent.
GnuPG version 2.5.21 for Windows has a vulnerability due to incorrect permission assignment on the C:\ProgramData directory. This allows low-privilege users to create subdirectories and inject malicious configuration files that GnuPG components will consume, potentially leading to code execution under the victim user's security context.
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.
CVE-2026-108141 is a path traversal vulnerability in Veeam Backup and Replication that allows an authenticated user with the Restore Operator role, who can control a backed-up NAS share, to write files to arbitrary paths on the backup server via relative path traversal. This flaw affects versions 13.0 up to but not including 13.0.3 and 13.1 up to but not including 13.1.2. The vulnerability has a medium severity with a CVSS score of 5.9. Fixed versions are 13.0.3 and 13.1.2.
CVE-2026-106077 is a high-severity vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.5.0.1014. It allows a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges, potentially exposing sensitive data. A patch is available for this issue.
CVE-2026-106076 is a critical SQL injection vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.5.0.1014. It allows an authenticated organization-transfer peer to inject SQL commands into the source server's configuration database, potentially enabling cross-tenant data access and remote code execution as the PostgreSQL service account.