CVE-2026-108328 is a vulnerability in Tanium Threat Response where sensitive information could be inserted into log files. This issue affects specific versions prior to fixed releases. The vulnerability has a medium severity score and does not have known exploits in the wild. Tanium has addressed the issue in versions 4.9.476, 4.12.349, and 4.17.327.
CVE-2026-116678 is a server-side request forgery (SSRF) vulnerability in Vaultwarden versions prior to 1.37.0. The flaw arises because the icon downloader does not properly apply host-blocking checks to second-stage favicon URLs parsed from attacker-controlled HTML, allowing an unauthenticated remote attacker to cause the server to make requests to internal or loopback IP addresses. This can expose internal responses or reveal network reachability information. The issue is fixed in version 1.37.0.
GnuPG version 2.5.21 for Windows has a vulnerability due to incorrect permission assignment on the C:\ProgramData directory. This allows low-privilege users to create subdirectories and inject malicious configuration files that GnuPG components will consume, potentially leading to code execution under the victim user's security context.
OpenWISP Controller versions from 1.0.0 up to but not including 1.3.2 contain an authorization bypass vulnerability in the GET /api/v1/controller/ca/<integer-id>/crl endpoint. An authenticated organization manager with CA view permission can access certificate revocation lists (CRLs) belonging to other organizations by exploiting improper authorization checks. The vulnerability exposes CA issuer information and revoked certificate serial numbers but does not disclose private keys or allow data modification. This issue is resolved in version 1.3.2.
CVE-2026-16491 is a missing authorization vulnerability in Grafana Enterprise's RBAC service. It causes the system to ignore the requested folder when verifying folder administrator status for deleted dashboard listings. As a result, users with dashboard permission-management rights on any folder could be mistakenly treated as administrators of all folders, potentially exposing deleted dashboard items from folders where they lack administrative access. The issue affects multiple versions of Grafana Enterprise 13.0.0 through 13.1.1. A fix requires proper permission checks on the specified folder, its ancestors, or a wildcard scope.
An SQL injection vulnerability exists in the oretnom23 php-travel-agency-system affecting an unknown function in traceapplication.php via the Search parameter. The flaw allows remote attackers to manipulate SQL queries. Public exploit code has been released, but the vendor has not yet responded or issued a fix.
CVE-2026-116676 is a command injection vulnerability in Atlantis, a self-hosted Golang application for Terraform pull request automation. Versions from 0.4.0 up to but not including 0.47.1 allow authenticated contributors to inject arbitrary shell commands via the workspace name in atlantis.yaml. This occurs because the workspace value is passed unsafely to a shell command executed with sh -c. Exploitation can lead to arbitrary command execution with the privileges of the Atlantis service account, exposing sensitive credentials and resources. The issue is fixed in version 0.47.1.
Hydra core versions 1.3.6 through 1.3.7 and 1.4.0.dev9 through 1.4.0rc2 have a vulnerability in the legacy target blacklist that omits unsafe PyYAML loading functions. This allows an attacker who controls the target and arguments passed to instantiate() to execute arbitrary Python code via a malicious YAML configuration. The issue affects legacy no-whitelist paths and is not a bypass of Hydra 1.4's execution whitelist. The vulnerability is fixed in versions 1.3.8 and 1.4.0rc3.
Adobe Campaign Classic contains an OS Command Injection vulnerability (CWE-78) that allows a low-privileged attacker to execute arbitrary code without user interaction. This vulnerability affects the product in version 0 and has a critical severity rating with a CVSS score of 9.9. The vulnerability changes the security scope and could lead to full compromise of confidentiality, integrity, and availability in the context of the current user.
Adobe Campaign Classic contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code with the privileges of the current user. This vulnerability does not require user interaction and changes the security scope, making it critical.
Adobe Campaign Classic contains an SQL Injection vulnerability (CWE-89) that allows a low-privileged attacker to execute arbitrary code without user interaction. The vulnerability affects version 0 of the product and has a critical severity with a CVSS score of 9.9. Exploitation changes the security scope and can lead to full compromise of confidentiality, integrity, and availability in the context of the current user.
Adobe Campaign Classic contains a reflected Cross-Site Scripting (XSS) vulnerability (CVE-2026-104350) that allows attackers to inject malicious scripts via crafted URLs or compromised web pages. Successful exploitation requires user interaction and can lead to elevated access or control over the victim's account or session. The vulnerability has a critical severity rating with a CVSS score of 9.3.
Adobe Campaign Classic (ACC) suffers from a critical SQL Injection vulnerability (CWE-89) that allows an attacker to execute arbitrary SQL commands without user interaction. This flaw could lead to arbitrary code execution within the context of the current user, potentially enabling elevated access or control over the victim's account or session. The vulnerability affects version 0 of the product and has a CVSS 3.1 base score of 10.0, indicating maximum severity.
Adobe Campaign Classic contains a critical code injection vulnerability (CWE-94) that allows a low-privileged attacker to execute arbitrary code without user interaction. This vulnerability changes the security scope and could lead to full compromise of the affected system under the context of the current user.
Adobe Campaign Classic contains an SQL Injection vulnerability that allows an attacker with high privileges to execute arbitrary code without user interaction. This vulnerability affects version 0 of the product and can lead to a complete compromise of confidentiality, integrity, and availability. The vulnerability changes the security scope, increasing its impact.
Adobe Campaign Classic contains an SQL Injection vulnerability that allows a low-privileged attacker to bypass security features and gain unauthorized read and limited write access without user interaction. The vulnerability changes the security scope and has a critical severity rating.
CVE-2026-117514 is a SQL injection vulnerability in the oretnom23 php-travel-agency-system affecting the admin/customer_detail.php file. The flaw arises from improper handling of parameters such as costomer_id, ticket_id, emp_id, salary_id, and page_id, allowing remote attackers to inject SQL commands. Exploit code is publicly available, but no official response or patch has been issued by the vendor.
CVE-2026-57189 is an out-of-bounds write vulnerability in the Asterisk telephony toolkit affecting the chan_sip channel driver when its textsupport option is enabled. An authenticated attacker can trigger a T.140 RED out-of-bounds write during generation accumulation, potentially leading to remote code execution or a crash. The chan_sip driver is deprecated in Asterisk 20 and removed in later versions. Fixes are available in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and corresponding certified releases.
CVE-2026-57201 is a high-severity stack buffer overflow vulnerability in the Asterisk telephony toolkit's H.323 chan_ooh323 addon channel driver. It arises from an unbounded vsprintf write into a fixed 2048-byte buffer in the ooTrace() trace-logging function. This can cause the Asterisk process to crash when processing a crafted packet. The vulnerable chan_ooh323 driver is not enabled by default and requires explicit compilation and a publicly reachable port. The issue is fixed in multiple Asterisk releases including 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk versions 20.7-cert11 and 22.8-cert3.
CVE-2026-114598 is a high-severity vulnerability in EPICS Base versions up to and including 7.0.10. It involves insufficient validation of element or length values in network messages, which can cause the application to read beyond allocated buffer bounds. This flaw can lead to denial of service and potential exposure of adjacent memory contents.