A vulnerability in dnspython's dns.name.from_wire_parser() function can cause excessive CPU usage when processing maliciously crafted DNS messages. This can degrade or deny service to applications handling untrusted DNS wire format messages. The issue is fixed in dnspython version 2.9.0. No workarounds are currently known.
NextChat version 2.16.1 has a client-side cross-site scripting (XSS) vulnerability in its Plugin Editor. This flaw arises from unsafe rendering of externally supplied OpenAPI plugin schema content without proper sanitization. An attacker can craft a malicious OpenAPI schema hosted remotely and trick a user into loading it, leading to arbitrary JavaScript execution within the NextChat application context. Exploitation could expose JavaScript-readable cookies and other client-side data tied to NextChat.
A SQL injection vulnerability exists in the oretnom23 php-travel-agency-system in the traceapplication.php file via the Search argument. This flaw allows remote attackers to manipulate SQL queries, potentially leading to data disclosure, modification, or denial of service. The vulnerability has a CVSS score of 7.3 (high severity). Public exploit code is available, but no official response or patch has been issued by the project.
A SQL injection vulnerability was identified and addressed in Tanium Provision. This vulnerability allows an attacker with low privileges to execute unauthorized SQL commands, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability has a medium severity rating with a CVSS score of 6.3.
CVE-2026-88812 is a high-severity vulnerability involving a double free flaw in the XKB SetGeometry function of X.Org X Server versions before 21.1.25 and X Wayland versions before 24.1.14. This flaw could allow attached clients with limited privileges to cause a crash or potentially execute code within the X server context.
A SQL injection vulnerability exists in the contact_insert.php file of the oretnom23 php-travel-agency-system. This flaw allows remote attackers to manipulate input fields such as name, company, email, topic, phone, and comments to execute SQL injection attacks. The vulnerability has a high severity score and public exploit code is available. The project has been notified but has not yet responded or issued a fix.
A vulnerability in Grafana's RBAC service caused it to ignore the requested folder when verifying folder administrator status for deleted dashboard listings. This flaw allowed users with dashboard permission-management rights on any folder to be treated as administrators of all folders, potentially exposing deleted dashboard items from folders where they lacked administrative access. The issue is addressed by requiring permission on the specified folder, an ancestor folder, or a wildcard scope.
A code injection vulnerability exists in reduxjs redux-devtools version 5.0.0 in the evalAction function of the Remotedev Server component. The vulnerability requires local access to exploit. Public exploit code is available, but no vendor response or patch has been issued yet. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A denial of service vulnerability was addressed by Tanium in their Provision product. The flaw could allow an unauthenticated attacker to cause a denial of service condition, impacting availability. The vulnerability has a high severity rating with a CVSS score of 7.5. No affected versions or patch details are provided in the available data.
GnuPG version 2.5.21 for Windows has a vulnerability due to default DACL inheritance on the C:\ProgramData directory. This allows low-privilege users to create arbitrary subdirectories and inject malicious configuration files that GnuPG components will consume, potentially leading to code execution under the victim user's security context.
A compression bomb vulnerability was identified and addressed in Tanium Enforce. This vulnerability can cause a denial of service condition by exhausting system resources when processing specially crafted compressed data.
Tanium Enforce contains an improper access controls vulnerability identified as CVE-2026-116660. This flaw allows unauthorized access due to insufficient enforcement of access restrictions. The vulnerability has a medium severity with a CVSS score of 4.3, indicating limited impact primarily on confidentiality. No public exploits or known active exploitation have been reported. No specific affected versions or patch information are provided.
Tanium Enforce contains an uncontrolled resource consumption vulnerability (CVE-2026-116659) that could allow an attacker with low privileges to cause a denial of service by exhausting resources. The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS score is 4.3 (medium severity). No affected versions or patch information is provided.
A denial of service vulnerability was identified and addressed in Tanium Enforce. The flaw could allow an attacker with low privileges to cause a denial of service condition, impacting availability. No public exploit or active exploitation is known. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A vulnerability identified as CVE-2026-108332 affects the Tanium Threat Response Client Extension. It involves improper link resolution before file access, which could allow an attacker with local access and low privileges to cause high confidentiality and integrity impact. The vulnerability has a medium severity rating with a CVSS score of 6.3.
A high-severity vulnerability (CVE-2026-116649) was identified in Tanium Enforce involving improper output sanitization. This flaw could allow an attacker to cause partial confidentiality, integrity, and availability impacts. The vulnerability has a CVSS score of 7.1, indicating significant risk. No affected versions or patch information are explicitly provided in the available data.
A high-severity vulnerability (CVE-2026-116656) in Tanium Enforce allows uncontrolled resource consumption, potentially leading to denial of service. The flaw does not impact confidentiality or integrity but can cause availability disruption. No affected versions or patch information are currently provided.
A denial of service vulnerability was identified and addressed in Tanium Enforce. The flaw allows an unauthenticated attacker to cause a denial of service condition, impacting availability without affecting confidentiality or integrity.
An information disclosure vulnerability was addressed by Tanium in the Threat Response Client Extension. The vulnerability is identified as CVE-2026-108330 and has a low severity score. It involves a flaw categorized under CWE-125 (Out-of-bounds Read). No specific affected versions or patch details are provided.