CVE-2026-49311

CVE-2026-49311 is a permission control vulnerability in the event notification module affecting Huawei consumer devices (phones, vision/wearables, and laptops). The CVSS 3.1 score is 6.2 (MEDIUM) with a local attack vector , low complexity , no privileges required , and no user interaction needed...

CVE-2026-13709

The Graphina – Charts and Graphs For Elementor WordPress plugin (all versions up to and including 3.1.11 ) contains a Stored Cross-Site Scripting (XSS) vulnerability in the iq_tree_tree_chart_template Widget Setting , caused by insufficient input sanitization and output escaping. An authenticated...

CVE-2026-15406

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion via the event_layout parameter in all versions up to and including 4.1.22 . Authenticated attackers with custom-level access or above can include and execute...

CVE-2026-15667

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is affected by a Local File Inclusion vulnerability in all versions up to and including 4.1.22 , exploitable via the event_layout parameter. Because the etn_manage_event capability is assigned to...

CVE-2026-76801

CVE-2026-76801 affects the FireBox WordPress plugin (WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment) in versions up to and including 3.1.10 . The root cause is a trivially bypassable regex blacklist in Executer::allowedToRun() that fails to block WordPress core funct...

CVE-2026-13359

The Contact Form to DB by BestWebSoft WordPress plugin (versions up to and including 1.7.5 ) is vulnerable to unauthenticated Stored Cross-Site Scripting via the cntctfrm_contact_dropdown parameter, caused by insufficient input sanitization and output escaping. An attacker can inject a payload by...

CVE-2026-12956

The WP Event Solution (Eventin) WordPress plugin (versions ≤ 4.1.22 ) is affected by a Missing Authorization vulnerability in the /wp-json/eventin/v2/orders REST endpoint. The create_item_permissions_check() function relies solely on a wp_rest nonce that is leaked to every visitor via the etn-pub...

CVE-2026-87021

Tanium Comply is affected by an unauthorized code execution vulnerability. The CVSS v3.1 score is 7.2 (HIGH) , with a network attack vector, low complexity, and high privileges required , resulting in high impact on confidentiality, integrity, and availability. No user interaction is needed. Tani...

CVE-2026-87036

Tanium Comply is affected by an improper access controls vulnerability, rated HIGH (CVSS 8.1) due to network-reachable, low-privilege exploitation causing high integrity and availability impact with no confidentiality loss. Tanium has addressed the issue, with details available via their security...

CVE-2026-87023

Tanium Comply is affected by a path traversal vulnerability that has been addressed by the vendor. The CVSS 3.1 score is 8.5 (HIGH) , with a network attack vector, low complexity, low privileges required, no user interaction, and changed scope —implying the vulnerable component may reside in a di...

CVE-2026-87034

Tanium Comply was affected by a SQL injection vulnerability that has been addressed by the vendor. The vulnerability is rated CVSS 8.3 (HIGH) with a vector of AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating a network-accessible flaw requiring user interaction and high attack complexity , but with...

CVE-2026-87084

Tanium Enforce is affected by a server-side request forgery (SSRF) vulnerability, rated 7.7 (HIGH) by Tanium's CVSS v3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). The vulnerability allows a network-based attacker with low privileges to exploit the flaw without user interaction, resulting ...

CVE-2026-87048

Tanium Comply contained an improper access controls vulnerability, rated CVSS 5.4 (Medium) . The vector is network-based with low attack complexity and low privileges required , no user interaction, resulting in low impact to integrity and availability with no confidentiality impact. Tanium has a...

CVE-2026-87073

Tanium Comply is affected by an improper access controls vulnerability, as addressed by Tanium and referenced in advisory TAN-2026-029 . The CVSS 3.1 score is 6.5 (MEDIUM) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N , indicating a network-based attack with low complexity and low privilege...

CVE-2026-87072

Tanium Comply is affected by an improper access controls vulnerability, rated CVSS 7.1 (HIGH) . The attack vector is network-based , requires low privileges and no user interaction , with high confidentiality and low integrity impact. Tanium has addressed the issue; details are available at the v...

CVE-2026-87032

Tanium Server is affected by an information disclosure vulnerability addressed by Tanium, per advisory TAN-2026-033 . The assigned CVSS 3.1 base score is 4.3 (MEDIUM) , with a network vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and a low confident...

CVE-2026-87035

Tanium addressed an information disclosure vulnerability in its Comply product. The CNA-assigned CVSS 3.1 score is 4.3 (MEDIUM) with a network attack vector, low complexity, low privileges required, no user interaction, and a low impact on confidentiality with no integrity or availability impact....

CVE-2026-87033

Tanium Comply is affected by an improper access controls vulnerability, rated CVSS 5.4 (MEDIUM) with a network vector, low attack complexity, and low required privileges. The vulnerability carries low integrity and availability impact with no confidentiality impact. Tanium has addressed the issue...

CVE-2026-14892

Tanium Server is affected by an improper access controls vulnerability, as disclosed in Tanium advisory TAN-2026-031 . The vulnerability has been addressed by Tanium. According to the CVSS 3.1 score of 4.3 (MEDIUM) , exploitation requires network access with low privileges and no user interaction...

CVE-2026-87030

Tanium Comply is affected by a path traversal vulnerability that Tanium has addressed (see TAN-2026-043 ). The vulnerability is rated CVSS 8.5 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L, indicating a network-exploitable flaw requiring low privileges and no user interaction, with ...

CVE-2026-87046

Tanium Comply contains an improper access controls vulnerability addressed by the vendor. The CVSS 3.1 score is 4.3 (MEDIUM) , with a network attack vector, low complexity, and low privileges required. The impact is limited to low integrity with no reported confidentiality or availability impact....

CVE-2026-87025

Tanium Comply is affected by an improper access controls vulnerability, assigned CVE-2026-87025 . The flaw allows a network-based attacker with low privileges and no user interaction to achieve low integrity and low availability impact, but no confidentiality impact (CVSS 3.1 base score 5.4, MEDI...

CVE-2026-87075

Tanium Comply contains an improper access controls vulnerability that the vendor has addressed. The flaw carries a CVSS 3.1 score of 8.1 (HIGH) , with a network attack vector, low complexity, and low privileges required. Successful exploitation results in high integrity and high availability impa...

CVE-2026-87047

Tanium Comply is affected by an improper access controls vulnerability, assigned CVSS 3.1 score of 6.3 (Medium) with a network attack vector, low complexity, and low required privileges, resulting in low impacts to confidentiality, integrity, and availability. The vulnerability has been addressed...

CVE-2026-14505

Tanium Data Service contains a path traversal vulnerability that Tanium has addressed. The vulnerability requires network access , high attack complexity , and high privileges , with no user interaction needed, and can lead to high impact on confidentiality, integrity, and availability. It is rat...

CVE-2026-87019

Tanium Comply is affected by an improper access controls vulnerability, as reported by Tanium in advisory TAN-2026-035 . The issue was addressed by the vendor. The CVSS 3.1 score is 4.3 (MEDIUM) , with a network attack vector, low complexity, and low privileges required; the impact is limited to ...

CVE-2026-87037

Tanium Comply is affected by an improper access controls vulnerability, rated CVSS 5.4 (MEDIUM) with a network attack vector, low privileges required, and low impact on both confidentiality and integrity (no availability impact). Tanium has addressed the issue per its security advisory (TAN-2026-...

CVE-2026-87088

Tanium Enforce is affected by an unauthorized code execution vulnerability, for which Tanium has released an address. The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) with a local attack vector, high complexity, no privileges required, and user interaction required, leading to high impact...

CVE-2026-87724

Tor versions prior to 0.4.9.12 are affected by a denial-of-service vulnerability (TROVE-2026-032) in the congestion-control mechanism. The underlying cause is that Tor interprets the CC_RESPONSE extension even when CC_REQUEST was never sent, leading to a corrupted congestion-control state and an ...

CVE-2026-87083

A deserialization vulnerability exists in tile-ai tilelang (up to version 0.1.14), affecting the function KernelCache._load_kernel_from_disk in the file tilelang/cache/kernel_cache.py (component: Kernel Cache). The flaw can be triggered remotely with low privileges and required user interaction, ...

CVE-2026-87430

CVE-2026-87430 is a buffer overflow in the WebRTC component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can potentially execute arbitrary code inside the sandbox by serving a crafted HTML page to the user, requiring user interaction. Chromium assigned a Low security severi...

CVE-2026-87544

CVE-2026-87544 affects the Extensions component of Google Chrome prior to version 153.0.8010.36 , where an incorrect authorization flaw allows a remote attacker to bypass system access restrictions into a privileged page using a crafted HTML page. Chromium rated its severity as Low , while the NV...

CVE-2026-87593

An information leak in the Editing component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. The Chromium security severity is rated Low , while the CVSS v3.1 score is 6.5 (Medium) with a network vector requiring u...

CVE-2026-87437

CVE-2026-87437 is an information leak in the Frames component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to leak sensitive information. Chromium rates the severity as Low , while the assigned CVSS 3.1 score is 6.5 (MEDIUM) with high ...

CVE-2026-87608

CVE-2026-87608 is an improper certificate validation flaw in FedCM (Federated Credentials) in Google Chrome prior to 153.0.8010.36 . A remote attacker leveraging social engineering can use crafted network traffic to bypass web origin policy , rated Low severity by Chromium. The fix is included in...

CVE-2026-87477

CVE-2026-87477 is an information disclosure vulnerability in Google Chrome's Core component, affecting versions prior to 153.0.8010.36 . A remote attacker can exploit a crafted HTML page (with user interaction) to leak sensitive information. The Chromium project rates the severity as Low , while ...

CVE-2026-87601

A race condition in the V8 JavaScript engine in Google Chrome prior to 153.0.8010.36 allows a remote attacker to execute arbitrary code inside the sandbox by convincing a user to visit a crafted HTML page. Chromium rates the severity as Low , while the CNA CVSS v3.1 score is 7.5 (High) with high ...

CVE-2026-87602

CVE-2026-87602 is an out-of-bounds read in the ANGLE component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A remote attacker can read memory outside the sandbox by delivering a crafted HTML page to the user, requiring user interaction but no privileges. Chromium rate...

CVE-2026-87571

CVE-2026-87571 is an improper certificate validation vulnerability in the Loader component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker leveraging social engineering could use crafted network traffic to bypass the web origin policy , resulting in low confidenti...

CVE-2026-87551

CVE-2026-87551 addresses an improper certificate validation flaw in the CORS (Cross-Origin Resource Sharing) mechanism of Google Chrome prior to version 153.0.8010.36 . A remote attacker leveraging social engineering could craft network traffic to bypass the web origin policy , leading to a limit...

CVE-2026-87473

CVE-2026-87473 is an incorrect authorization flaw in the FileHandling component of Google Chrome prior to 153.0.8010.36 . A remote attacker, leveraging social engineering, can bypass system access restrictions by serving a crafted HTML page. The Chromium team rates the severity as Low . Users sho...

CVE-2026-87489

CVE-2026-87489 is a memory corruption vulnerability in the V8 engine of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can potentially exploit it via a crafted Chrome extension to execute arbitrary code inside the browser sandbox . The CVSS 3.1 score is 8.8 (High) w...

CVE-2026-87631

CVE-2026-87631 is a missing authorization vulnerability in the DOM component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can potentially leak sensitive information by serving a crafted HTML page to a victim who interacts with it (user interaction required). Ch...

CVE-2026-87461

An information leak in the Core component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted Chrome extension . Chromium rated the severity as Low , with a CVSS 3.1 base score of 4.3 (Medium) requiring user interaction but no privileges. CISA...

CVE-2026-87469

CVE-2026-87469 is an improper input validation vulnerability in the Extensions component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can leverage crafted network traffic to bypass web origin policy and gain access to a privileged page. Chromium classifies the severity as L...

CVE-2026-87575

An incorrect authorization vulnerability in the Loader component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker, leveraging social engineering and a crafted HTML page, to bypass system access restrictions. The flaw is rated Low severity by Chromium and scores 5.4 (Mediu...

CVE-2026-87490

An information disclosure vulnerability in the Transactions Platform component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain sensitive information by convincing a user to visit a crafted HTML page . The underlying root-cause mechanism beyond the crafted-page ...

CVE-2026-87605

CVE-2026-87605 is a missing authorization vulnerability in the Contacts component of Google Chrome prior to version 153.0.8010.36 . A remote attacker who had already compromised the renderer process could, by leveraging social engineering and serving a crafted HTML page, potentially obtain sensit...

CVE-2026-87583

A UI misrepresentation vulnerability in the Passwords component of Google Chrome on Android (prior to 153.0.8010.36 ) allows a remote attacker to spoof UI elements via a crafted HTML page. The attacker requires user interaction but no prior privileges, with the primary consequence being low impac...

CVE-2026-87597

Google Chrome on Android versions prior to 153.0.8010.36 are affected by a UI misrepresentation vulnerability in the CustomTabs component. A remote attacker could spoof the address bar by leveraging a co-installed app. The vulnerability is rated Low by Chromium and carries a CVSS 3.1 base score o...