CVE-2026-87076

Tanium Discover is affected by an information disclosure vulnerability, rated CVSS 3.1 6.5 (MEDIUM) with a network attack vector, low complexity, and low privileges required, resulting in a high confidentiality impact with no integrity or availability impact. Tanium has addressed the issue, and d...

CVE-2026-86865

Tanium Asset contains a SQL injection vulnerability that has been addressed by the vendor, as documented in advisory TAN-2026-049 . The vulnerability is rated CVSS 3.1 8.8 (HIGH) with a network vector, low attack complexity, and low privileges required , resulting in high impact to confidentialit...

CVE-2026-70469

Apache NiFi 2.11.0 introduced a framework enforcement filter that disabled gzip-encoded HTTP requests for the REST API by rejecting the standard Content-Encoding header. However, the filter failed to check for multiple instances of that header and did not reject non-standard identifiers for gzip ...

CVE-2026-81866

Apache NiFi 2.9.0 through 2.11.0 contain a missing authorization vulnerability in the Connector configuration update and verification REST API methods. The framework enforced write permissions only on the Connector itself, without verifying read access to referenced Parameter Providers or Asset o...

CVE-2026-82561

Apache NiFi versions 1.5.0 through 2.11.0 contain a missing authorization flaw in REST API methods used for Process Group flow replacement and versioned flow update/rebase operations. These methods only checked read/write permissions on the Process Group itself, unlike their asynchronous counterp...

CVE-2026-86089

Apache NiFi 2.11.0 introduced REST API methods to migrate version-controlled Process Groups into a Connector . The authorization check was performed only against the target Connector, not against the source Process Group, allowing an authenticated user with read access to a Connector to enumerate...

CVE-2026-87976

Apache NiFi Registry versions 0.4.0 through 2.11.0 are vulnerable to path manipulation in the default file persistence provider. When storing extension bundle content, the provider used group, artifact, and version coordinates from uploaded NAR manifests as filesystem path components without reje...

CVE-2026-76646

Apache MyFaces is vulnerable to a denial of service condition caused by unbounded request parsing . A remote attacker can supply specially crafted request parameters that trigger excessive resource consumption on the server. CISA's SSVC assessment rates exploitation as none , automatability as ye...

CVE-2026-92474

A use after free vulnerability exists in the Proto Link Handler component of GPAC 26.08-DEV , specifically in the function gf_inline_get_proto_lib within src/compositor/mpeg4_inline.c. The flaw requires a local attack with low complexity and low privileges. Per CVSS 3.1, the impact is LOW (base s...

CVE-2026-63225

Redocly CLI prior to @redocly/cli 2.33.2 is vulnerable to a path traversal in the split command. The command constructs output file paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying the resolved target remains inside the select...

CVE-2026-63325

@redocly/respect-core and @redocly/cli (Redocly CLI) before version 2.33.0 contain an arbitrary code execution vulnerability in the respect command. The root cause is dynamic evaluation of $faker runtime expressions in Arazzo descriptions: a crafted expression can traverse constructor , prototype...

CVE-2026-86071

CVE-2026-86071 affects Junrar , an open-source Java RAR archive library. Prior to version 7.6.1 , the LocalFolderExtractor class in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. The ro...

CVE-2026-73462

CVE-2026-73462 affects the IGMP snooping agent in Arista EOS . An adjacent, unauthenticated attacker can send malformed packets to trigger an out-of-bounds read (CWE-125) , crashing the agent and causing multicast traffic to flood all ports on the affected VLAN. Repeated exploitation may lead to ...

CVE-2026-92473

A use-after-free vulnerability was identified in the GPAC multimedia framework (version 26.08-DEV), specifically in the function gf_sg_command_del within src/scenegraph/commands.c , part of the BIFS Handler component. An attacker with local access can trigger the flaw, resulting in a low availabi...

CVE-2026-73457

CVE-2026-73457 affects Arista EOS platforms with the gRPC Network Packet Sampling Interface (gNPSI) enabled. When the EosRpcAuth trace facility is explicitly activated on the Gnpsi agent, client credentials (username and password) are written in clear text to local or remote accounting logs, acce...

CVE-2026-91106

HP has identified and remediated multiple externally reported vulnerabilities in HP Linux Imaging and Printing (HPLIP) software. The findings affect several software components and could potentially enable remote code execution , privilege escalation , denial of service , information disclosure ,...

CVE-2026-73456

Arista EOS platforms with the gNPSI (gRPC Network Packet Sampling Interface) enabled are vulnerable to unauthenticated arbitrary code execution via crafted gNPSI requests (CWE-94, code injection), granting full administrative control of the switch. CVSS 3.1 score: 10.0 . Exploitation requires gNP...

CVE-2026-91105

The HP Linux Imaging and Printing (HPLIP) software contains multiple vulnerabilities in several software components. These flaws could potentially allow a remote attacker to achieve remote code execution , privilege escalation , denial of service , information disclosure , or unauthorized file mo...

CVE-2026-91104

HP has remediated multiple externally reported vulnerabilities in HPLIP (HP Linux Imaging and Printing) , a software suite for Linux printing. The findings affect several software components and could potentially enable remote code execution, privilege escalation, denial of service, information d...

CVE-2026-91103

The HPLIP (HP Linux Imaging and Printing) software suite is affected by multiple vulnerabilities that could enable remote code execution , privilege escalation , denial of service , information disclosure , or unauthorized file modification . Technical analysis identifies the underlying cause as ...