CVE-2026-116657 is a denial of service vulnerability in Tanium Enforce caused by allocation of resources without limits or throttling. This flaw could allow an unauthenticated remote attacker to exhaust system resources, leading to service disruption. Tanium has addressed this issue in versions 2.9.736, 2.10.778, and 3.0.373.
A use-after-free vulnerability was identified and addressed in the Tanium Endpoint Configuration Toolset Solution's Threat Response Client Extension. This flaw could potentially lead to a denial of service condition due to application crashes. The vulnerability has a low severity rating and does not impact confidentiality or integrity. Multiple versions prior to the fixed releases are affected.
A heap-based buffer overflow vulnerability exists in the Tanium Endpoint Configuration Toolset Solution. This flaw affects multiple versions prior to fixed releases and can lead to high-impact consequences including confidentiality, integrity, and availability compromises. Tanium has addressed this vulnerability in specific patched versions.
Neko versions from 3.0.0 up to but not including 3.1.5 have an incorrect authorization vulnerability in legacy mode with session.implicit_hosting enabled. This flaw allows authenticated room members to send mouse and keyboard events via the legacy WebRTC data channel even when controls are locked or the member is unauthorized by the modern control API. The issue is fixed in version 3.1.5.
A denial of service vulnerability exists in Tanium Server due to allocation of resources without limits or throttling. This flaw can cause the server to become unavailable by exhausting resources. Tanium has addressed this issue in specific fixed versions.
CVE-2026-116662 is a high-severity vulnerability in Tanium Enforce involving improper handling of highly compressed data, also known as a compression bomb. This flaw can cause a denial of service by amplifying data processing requirements. Tanium has fixed this issue in versions 2.9.736, 2.10.778, and 3.0.373.
CVE-2026-108305 is a local privilege escalation vulnerability in the Tanium Endpoint Configuration Toolset Solution affecting End-User Notifications. It involves improper link resolution before file access, also known as 'link following'. The vulnerability has a high severity with a CVSS score of 7.8 and impacts confidentiality, integrity, and availability. Tanium has released fixed versions to address this issue.
CVE-2026-108331 is an infinite loop vulnerability in the Tanium Endpoint Configuration Toolset Solution's Threat Response Client Extension. This flaw can cause uncontrolled recursion leading to a denial of service condition. Tanium has addressed this issue in fixed versions.
CVE-2026-87085 is a SQL injection vulnerability in Tanium Provision that allows improper neutralization of special elements used in SQL commands. This flaw was addressed by Tanium in versions 1.17.150, 1.23.161, and 1.24.199. The vulnerability has a medium severity with a CVSS score of 6.5, indicating it requires low privileges to exploit and can impact confidentiality, integrity, and availability to a limited extent.
A SQL injection vulnerability was identified and addressed in Tanium Patch. This flaw involves improper neutralization of special elements in SQL commands, potentially allowing an attacker with low privileges to cause a high-impact confidentiality breach. The vulnerability affects multiple versions prior to specific fixed releases.
CVE-2026-117516 is a SQL injection vulnerability in the php-travel-agency-system by oretnom23. The flaw exists in the contact_insert.php file's contact form handler, where manipulation of input fields such as name, company, email, topic, phone, or comments can lead to SQL injection. This vulnerability can be exploited remotely without authentication. Public exploit code is available, but the vendor has not yet responded or issued a fix.
CVE-2026-108328 is a vulnerability in Tanium Threat Response where sensitive information could be inserted into log files. This issue affects specific versions prior to fixed releases. The vulnerability has a medium severity score and does not have known exploits in the wild. Tanium has addressed the issue in versions 4.9.476, 4.12.349, and 4.17.327.
CVE-2026-116678 is a server-side request forgery (SSRF) vulnerability in Vaultwarden versions prior to 1.37.0. The flaw arises because the icon downloader does not properly apply host-blocking checks to second-stage favicon URLs parsed from attacker-controlled HTML, allowing an unauthenticated remote attacker to cause the server to make requests to internal or loopback IP addresses. This can expose internal responses or reveal network reachability information. The issue is fixed in version 1.37.0.
GnuPG version 2.5.21 for Windows has a vulnerability due to incorrect permission assignment on the C:\ProgramData directory. This allows low-privilege users to create subdirectories and inject malicious configuration files that GnuPG components will consume, potentially leading to code execution under the victim user's security context.
OpenWISP Controller versions from 1.0.0 up to but not including 1.3.2 contain an authorization bypass vulnerability in the GET /api/v1/controller/ca/<integer-id>/crl endpoint. An authenticated organization manager with CA view permission can access certificate revocation lists (CRLs) belonging to other organizations by exploiting improper authorization checks. The vulnerability exposes CA issuer information and revoked certificate serial numbers but does not disclose private keys or allow data modification. This issue is resolved in version 1.3.2.
CVE-2026-16491 is a missing authorization vulnerability in Grafana Enterprise's RBAC service. It causes the system to ignore the requested folder when verifying folder administrator status for deleted dashboard listings. As a result, users with dashboard permission-management rights on any folder could be mistakenly treated as administrators of all folders, potentially exposing deleted dashboard items from folders where they lack administrative access. The issue affects multiple versions of Grafana Enterprise 13.0.0 through 13.1.1. A fix requires proper permission checks on the specified folder, its ancestors, or a wildcard scope.
An SQL injection vulnerability exists in the oretnom23 php-travel-agency-system affecting an unknown function in traceapplication.php via the Search parameter. The flaw allows remote attackers to manipulate SQL queries. Public exploit code has been released, but the vendor has not yet responded or issued a fix.
CVE-2026-116676 is a command injection vulnerability in Atlantis, a self-hosted Golang application for Terraform pull request automation. Versions from 0.4.0 up to but not including 0.47.1 allow authenticated contributors to inject arbitrary shell commands via the workspace name in atlantis.yaml. This occurs because the workspace value is passed unsafely to a shell command executed with sh -c. Exploitation can lead to arbitrary command execution with the privileges of the Atlantis service account, exposing sensitive credentials and resources. The issue is fixed in version 0.47.1.
Hydra core versions 1.3.6 through 1.3.7 and 1.4.0.dev9 through 1.4.0rc2 have a vulnerability in the legacy target blacklist that omits unsafe PyYAML loading functions. This allows an attacker who controls the target and arguments passed to instantiate() to execute arbitrary Python code via a malicious YAML configuration. The issue affects legacy no-whitelist paths and is not a bypass of Hydra 1.4's execution whitelist. The vulnerability is fixed in versions 1.3.8 and 1.4.0rc3.
Adobe Campaign Classic contains an OS Command Injection vulnerability (CWE-78) that allows a low-privileged attacker to execute arbitrary code without user interaction. This vulnerability affects the product in version 0 and has a critical severity rating with a CVSS score of 9.9. The vulnerability changes the security scope and could lead to full compromise of confidentiality, integrity, and availability in the context of the current user.