HomeBox versions prior to 0.27.0 contain a server-side request forgery (SSRF) vulnerability due to improper handling of HTTP redirects in notifier URL validation. Authenticated users can exploit this by configuring notifier hosts that redirect to restricted internal addresses, bypassing SSRF protections. The issue affects immediate and scheduled notifier requests. It is fixed in version 0.27.0.
CVE-2026-88812 is a high-severity vulnerability in X.Org X Server and X Wayland involving a double free in the XKB SetGeometry function. This flaw affects versions of xorg-x11-server before 21.1.25 and X Wayland before 24.1.14. Exploitation could allow attached clients to cause a crash or potentially execute code within the X server context. The issue has been fixed in versions 21.1.25 and 24.1.14.
CVE-2026-102816 is an authorization vulnerability in the country or region configuration interface of the TP-Link RE305 v3 device. An unauthenticated attacker on the same local network can modify the wireless regulatory region settings, causing the device to reapply wireless configurations. Exploitation can disrupt wireless connections, cause channel unavailability, client disconnections, and wireless instability by applying parameters intended for different regulatory regions. The vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in firmware version 1.1.8 Build 20260921 Rel. 42853.
CVE-2026-102815 is an operating-system command injection vulnerability in the tmpServer service of TP-Link RE305 v3. The vulnerable service runs with root privileges and listens on the local loopback interface. A local attacker with low privileges on the device can exploit this flaw by submitting crafted requests to the TDDPv1 service, resulting in execution of arbitrary OS commands with root privileges. This vulnerability allows privilege escalation from a low-privileged process to root on the affected device.
CVE-2026-102814 is an OS command injection vulnerability in the TP-Link RE305 v3 device's TDDP v2 service. The service uses a fixed and derivable cryptographic key, allowing an unauthenticated attacker on the same local network to forge protocol packets and access privileged operations. This can lead to arbitrary system command execution with root privileges. The vulnerability affects version 0 and is fixed in version 1.1.8 Build 20260921 Rel. 42853. The CVSS 4.0 score is 8.7, indicating high severity.
CVE-2026-102813 is a vulnerability in the password-recovery functionality of the TP-Link RE305 V3 device. An unauthenticated attacker on the local network can trigger generation of an administrator password-reset verification code via a verification-code interface. This interface lacks effective attempt counters or lockout mechanisms and uses a predictable verification-code generation process, allowing brute-force or code prediction attacks. Successful exploitation enables the attacker to reset the administrator password and gain privileged device management access. A fix is available in version 1.1.8 Build 20260921 Rel. 42853.
CVE-2026-102812 is a vulnerability in TP-Link RE305 v3 and Archer C7 v5 devices where a hard-coded AES-128 cryptographic key and initialization vector are embedded in the firmware's configuration backup mechanism. This flaw allows an attacker who obtains a backup file to decrypt it and access sensitive configuration data such as administrator passwords and Wi-Fi credentials. The vulnerability has a medium severity with a CVSS 4.0 score of 6.9. Fixed versions 1.1.8 Build 20260921 Rel. 42853 and 1.3.1 Build 20260821 Rel. 41256 address this issue.
NextChat version 2.16.1 has a client-side cross-site scripting (XSS) vulnerability in its Plugin Editor. This flaw arises from unsafe rendering of externally supplied OpenAPI plugin schema content using React's dangerouslySetInnerHTML without proper sanitization. An attacker can host a malicious OpenAPI schema and trick a user into loading it, leading to arbitrary JavaScript execution within the NextChat application context. Exploitation could expose JavaScript-accessible cookies and other client-side data.
CVE-2026-108311 is a low-severity vulnerability in Tanium Server involving insufficient logging. This issue was addressed by Tanium in specific fixed versions. The vulnerability does not impact confidentiality or availability but may affect integrity due to limited logging capabilities. No known exploits are reported in the wild.
CVE-2026-108303 is a high-severity vulnerability in Tanium Certificate Manager that allows unauthorized code execution due to improper neutralization of special elements in commands, commonly known as command injection. The flaw affects versions 1.17 up to but not including 1.17.417, 1.18 up to but not including 1.18.368, and 1.22 up to but not including 1.22.119. Tanium has released fixed versions to address this issue.
An information disclosure vulnerability was identified and addressed in Tanium Server. The issue involves the generation of error messages that contain sensitive information. This vulnerability affects specific versions of Tanium Server prior to fixed releases. The CVSS score is 4.3, indicating a medium severity level.
CVE-2026-116656 is a high-severity vulnerability in Tanium Enforce that allows uncontrolled resource consumption. This flaw affects multiple versions prior to fixed releases and could lead to denial of service conditions. Tanium has addressed this issue in versions 2.9.736, 2.10.778, and 3.0.373.
CVE-2026-108325 is a vulnerability in Tanium Reputation that involves the insertion of sensitive information into log files. This flaw could lead to unauthorized disclosure of sensitive data through logs. Tanium has fixed this issue in versions 6.6.145, 6.7.138, and 6.8.162.
CVE-2026-116659 is a medium severity vulnerability in Tanium Enforce where the product allowed allocation of resources without limits or throttling, leading to uncontrolled resource consumption. This flaw was addressed by Tanium in versions 2.9.736, 2.10.778, and 3.0.373.
CVE-2026-108302 is an improper access control vulnerability in Tanium Comply that allows users with limited privileges to access resources they should not. The issue affects multiple versions prior to specific fixed releases. Tanium has addressed this vulnerability in versions 2.32.263, 2.35.323, and 2.37.326. The CVSS 3.1 base score is 4.3, indicating a medium severity impact with limited confidentiality impact and no integrity or availability impact.
CVE-2026-108306 is a local privilege escalation vulnerability in the Tanium Endpoint Configuration Toolset Solution affecting End-User Notifications. The flaw involves improper link resolution before file access, also known as 'link following'. This vulnerability has a high severity with a CVSS score of 7.8. Tanium has released fixed versions that address this issue.
CVE-2026-108329 is a high-severity vulnerability in Tanium Threat Response that allows unauthorized code execution due to improper neutralization of special elements in commands, commonly known as command injection. The flaw affects multiple versions prior to fixed releases. Tanium has addressed this issue in versions 4.9.476, 4.12.349, and 4.17.327.
CVE-2026-108332 is a vulnerability in the Tanium Endpoint Configuration Toolset Solution involving improper link resolution before file access in the Threat Response Client Extension. This flaw could allow an attacker with limited privileges to cause high impact on confidentiality and integrity. Tanium has released fixes for multiple affected versions.
CVE-2026-108301 is a vulnerability in Tanium Comply involving missing authorization controls that could allow improper access. The issue affects multiple versions prior to fixed releases. Tanium has addressed this vulnerability in versions 2.32.263, 2.35.323, and 2.37.326. The CVSS v3.1 score is 6.0, indicating a medium severity impact with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.
CVE-2026-108304 is a local privilege escalation vulnerability in the Tanium Endpoint Configuration Toolset Solution affecting End-User Notifications. The flaw involves improper link resolution before file access, also known as 'link following'. Tanium has addressed this vulnerability in multiple fixed versions. The vulnerability has a high severity with a CVSS score of 7.8.