CVE-2025-15330: Missing Authorization

Tanium addressed an improper input validation vulnerability in Deploy...

CVE-2025-15329: Insertion of Sensitive Information Into Sent Data

Tanium addressed an information disclosure vulnerability in Threat Response...

CVE-2025-15328: Improper Link Resolution Before File Access

Tanium addressed an improper link resolution before file access vulnerability in Enforce...

CVE-2025-15325: Improper Neutralization of Special Elements used in an SQL Command

Tanium addressed an improper input validation vulnerability in Discover...

CVE-2025-15323: Improper Certificate Validation

Tanium addressed an improper certificate validation vulnerability in Tanium Appliance...

CVE-2025-15339: Incorrect Default Permissions

Tanium addressed an incorrect default permissions vulnerability in Discover...

CVE-2025-61732: Improper Control of Generation of Code

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary...

CVE-2025-58190: Loop with Unreachable Exit Condition

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

CVE-2025-15311: Improper Neutralization of Escape, Meta, or Control Sequences

Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance...

CVE-2025-15321: Untrusted Search Path

Tanium addressed an improper input validation vulnerability in Tanium Appliance...

CVE-2026-24300: Improper Access Control

Azure Front Door Elevation of Privilege Vulnerability...

CVE-2025-15312: Improper Encoding or Escaping of Output

Tanium addressed an improper output sanitization vulnerability in Tanium Appliance...

Detecting backdoored language models at scale

Today, we are releasing new research on detecting backdoors in open-weight language models. Our research highlights several key properties of language model backdoors, laying the groundwork for a practical scanner designed to detect backdoored models at scale and improve overall trust in AI...

CVE-2026-20056 Cisco Secure Web Appliance TBD Bypass Vulnerability

A vulnerability in the Dynamic Vectoring and Streaming DVS Engine implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass the anti-malware scanner, allowing malicious archive files to be downloaded. This vulnerability is du...

CVE-2026-20056

Cisco AsyncOS for Cisco Secure Web Appliance is affected by a DVS Engine vulnerability (CVE-2026-20056) that can allow an unauthenticated remote attacker to bypass the anti‑malware scanner and cause download of malicious archive files. The issue stems from improper handling of certain archives, e...

CVE-2023-38010: Generation of Error Message Containing Sensitive Information

IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system...

CVE-2026-1819: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Karel Electronics Industry and Trade Inc. ViPort allows Stored XSS. This issue affects ViPort: through 23012026...

CVE-2025-22873: Relative Path Traversal

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open"../" would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained with...

CVE-2026-20056: Download of Code Without Integrity Check

A vulnerability in the Dynamic Vectoring and Streaming DVS Engine implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass the anti-malware scanner, allowing malicious archive files to be downloaded. This vulnerability is du...

CVE-2025-59818: Improper Neutralization of Special Elements used in a Command

This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file...