CVE-2026-116683 CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfdteam.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixe...

CVE-2026-118180 Matrix homeserver could redirect the chat session to a local file or network share

When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, o...

CVE-2026-118179 Request forgery via news: links

Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary...

CVE-2026-118177 Calendar discovery accepted local file and remote network share locations

When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could mak...

CVE-2026-118178 RSS feed could redirect its subscription to a local file or network share

A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make...

CVE-2026-118176 Bypass of remote UNC path restriction in mailbox: URLs

Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows...

CVE-2026-118175 Content of other messages could be included when replying to a crafted message

When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was...

CVE-2026-118174 Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user...

CVE-2026-118173 MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement

MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy for example, TLP, the guard only verified that at least one tag of that...

CVE-2026-115413 AWS API MCP Server OAuth Token Audience Validation Bypass

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate th...

CVE-2026-118171 CVE-2026-118171

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions...

CVE-2026-118172 CVE-2026-118172

The strapi/strapi Core Admin / Webhook Runner package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target...

CVE-2026-118170 CVE-2026-118170

The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document...

CVE-2026-57202 Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface ARI attacker with read-only privileges may use setChannelVar to execute write...

CVE-2026-57188 Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in resxmpp XMPP namespace prefix handling using carefully craft...

CVE-2026-116682 FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

CVE-2026-117526 reduxjs redux-devtools Remotedev Server evalAction code injection

A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made publi...

CVE-2026-116680 Homebox generic notifier SSRF via HTTP redirect after URL validation

HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request through http.DefaultClient.Do without a CheckRedirect policy that...

CVE-2026-88812 X.Org Server XKB SetGeometry TextDoodad Double Free

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context...

CVE-2026-102816 Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305

An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration. Successful exploitation may cause...

CVE-2026-102815 Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305

An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the...

CVE-2026-102814 Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305

An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionalit...

CVE-2026-102813 Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305

An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effecti...

CVE-2026-102812 Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7

A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration...

CVE-2026-118132 CVE-2026-118132

NextChat version 2.16.1 contains a client‑side cross‑site scripting XSS vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, the returned content is stored in plugin.content and later...

CVE-2026-108303 Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.

Tanium addressed an unauthorized code execution vulnerability in Certificate Manager...

CVE-2026-108316 Tanium addressed an information disclosure vulnerability in Tanium Server.

Tanium addressed an information disclosure vulnerability in Tanium Server...

CVE-2026-108311 Tanium addressed an insufficient logging vulnerability in Tanium Server.

Tanium addressed an insufficient logging vulnerability in Tanium Server...

CVE-2026-108325 Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.

Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation...

CVE-2026-116656 Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce...

CVE-2026-108302 Tanium addressed an improper access controls vulnerability in Comply.

Tanium addressed an improper access controls vulnerability in Comply...

CVE-2026-116659 Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce...

CVE-2026-108306 Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

Tanium addressed a local privilege escalation vulnerability in End-User Notifications...

CVE-2026-108329 Tanium addressed an unauthorized code execution vulnerability in Threat Response.

Tanium addressed an unauthorized code execution vulnerability in Threat Response...

CVE-2026-108332 Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.

Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension...

CVE-2026-108301 Tanium addressed an improper access controls vulnerability in Comply.

Tanium addressed an improper access controls vulnerability in Comply...

CVE-2026-108304 Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

Tanium addressed a local privilege escalation vulnerability in End-User Notifications...

CVE-2026-108309 Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.

Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension...

CVE-2026-87086 Tanium addressed a denial of service vulnerability in Provision.

Tanium addressed a denial of service vulnerability in Provision...

CVE-2026-116658 Tanium addressed a denial of service vulnerability in Enforce.

Tanium addressed a denial of service vulnerability in Enforce...

CVE-2026-108313 Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server.

Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server...

CVE-2026-116660 Tanium addressed an improper access controls vulnerability in Enforce.

Tanium addressed an improper access controls vulnerability in Enforce...

CVE-2026-116649 Tanium addressed an improper output sanitization vulnerability in Enforce.

Tanium addressed an improper output sanitization vulnerability in Enforce...

CVE-2026-116647 Tanium addressed an improper output sanitization vulnerability in Comply.

Tanium addressed an improper output sanitization vulnerability in Comply...

CVE-2026-108326 Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.

Tanium addressed an improper certificate validation vulnerability in Stream Client Extension...

CVE-2026-108330 Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.

Tanium addressed an information disclosure vulnerability in Threat Response Client Extension...

CVE-2026-116657 Tanium addressed a denial of service vulnerability in Enforce.

Tanium addressed a denial of service vulnerability in Enforce...

CVE-2026-108333 Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.

Tanium addressed a use-after-free vulnerability in Threat Response Client Extension...

CVE-2026-108307 Tanium addressed a heap-based buffer overflow vulnerability in Index.

Tanium addressed a heap-based buffer overflow vulnerability in Index...

CVE-2026-116679 Neko: Authorization bypass in legacy WebRTC input handling

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicithosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost evaluates host status incorrectly. An...