CVE-2026-89082

CVE-2026-89082 affects HP Advance software running on the HP Advance server, with potential vulnerabilities enabling elevation of privilege , remote code execution , or arbitrary file write under certain conditions. The assigned CVSS 4.0 base score is 9.3 (CRITICAL) , with a network attack vector...

CVE-2026-86831

AWS EKS Network Policy Agent (aws-network-policy-agent) before v1.4.0 contains an improper validation flaw in pod identifier uniqueness. An authenticated remote attacker can craft pod and namespace names that produce identifier collisions , allowing bypass of NetworkPolicy enforcement on co-locat...

CVE-2026-92475

GPAC 26.08-DEV contains an out-of-bounds read vulnerability in the function wait_for_header_and_parse within the file src/utils/downloader.c. The flaw is triggered by manipulating the Content-Range argument, leading to an out-of-bounds memory read. Exploitation requires local access and low privi...

CVE-2026-87026

Tanium Threat Response is affected by an improper access controls vulnerability. The CNA-assigned CVSS v3.1 score is 3.8 (LOW) with a network vector, low attack complexity, and high privileges required , resulting in limited impact on confidentiality and integrity with no availability impact. The...

CVE-2026-87113

Tanium Threat Response contains an improper access controls vulnerability, assigned a CVSS v3.1 score of 6.3 (MEDIUM) with a network-based attack vector requiring only low privileges and no user interaction. The flaw impacts confidentiality, integrity, and availability at a low level each, with u...

CVE-2026-87105

Tanium Threat Response contains a SQL injection vulnerability that has been addressed by the vendor. The flaw is reachable over the network with low privileges and no user interaction , yielding high impact across confidentiality, integrity, and availability (CVSS 3.1 base score 8.8 – HIGH ). The...

CVE-2026-87116

Tanium addressed a server-side request forgery (SSRF) vulnerability in its Threat Response product. The flaw allows a network-based attacker with low privileges to forge requests from the server, resulting in a high confidentiality impact with no integrity or availability impact. Tanium scored th...

CVE-2026-87024

Tanium Asset contains a SQL injection vulnerability that has been addressed by the vendor (advisory TAN-2026-046 ). The CVSS 3.1 score is 7.5 (HIGH) , with network attack vector, high complexity, low privileges required, and high impact on confidentiality, integrity, and availability. No specific...

CVE-2026-87076

Tanium Discover is affected by an information disclosure vulnerability, rated CVSS 3.1 6.5 (MEDIUM) with a network attack vector, low complexity, and low privileges required, resulting in a high confidentiality impact with no integrity or availability impact. Tanium has addressed the issue, and d...

CVE-2026-86865

Tanium Asset contains a SQL injection vulnerability that has been addressed by the vendor, as documented in advisory TAN-2026-049 . The vulnerability is rated CVSS 3.1 8.8 (HIGH) with a network vector, low attack complexity, and low privileges required , resulting in high impact to confidentialit...

CVE-2026-70469

Apache NiFi 2.11.0 introduced a framework enforcement filter that disabled gzip-encoded HTTP requests for the REST API by rejecting the standard Content-Encoding header. However, the filter failed to check for multiple instances of that header and did not reject non-standard identifiers for gzip ...

CVE-2026-81866

Apache NiFi 2.9.0 through 2.11.0 contain a missing authorization vulnerability in the Connector configuration update and verification REST API methods. The framework enforced write permissions only on the Connector itself, without verifying read access to referenced Parameter Providers or Asset o...

CVE-2026-82561

Apache NiFi versions 1.5.0 through 2.11.0 contain a missing authorization flaw in REST API methods used for Process Group flow replacement and versioned flow update/rebase operations. These methods only checked read/write permissions on the Process Group itself, unlike their asynchronous counterp...

CVE-2026-86089

Apache NiFi 2.11.0 introduced REST API methods to migrate version-controlled Process Groups into a Connector . The authorization check was performed only against the target Connector, not against the source Process Group, allowing an authenticated user with read access to a Connector to enumerate...

CVE-2026-87976

Apache NiFi Registry versions 0.4.0 through 2.11.0 are vulnerable to path manipulation in the default file persistence provider. When storing extension bundle content, the provider used group, artifact, and version coordinates from uploaded NAR manifests as filesystem path components without reje...

CVE-2026-76646

Apache MyFaces is vulnerable to a denial of service condition caused by unbounded request parsing . A remote attacker can supply specially crafted request parameters that trigger excessive resource consumption on the server. CISA's SSVC assessment rates exploitation as none , automatability as ye...

CVE-2026-92474

A use after free vulnerability exists in the Proto Link Handler component of GPAC 26.08-DEV , specifically in the function gf_inline_get_proto_lib within src/compositor/mpeg4_inline.c. The flaw requires a local attack with low complexity and low privileges. Per CVSS 3.1, the impact is LOW (base s...

CVE-2026-63225

Redocly CLI prior to @redocly/cli 2.33.2 is vulnerable to a path traversal in the split command. The command constructs output file paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying the resolved target remains inside the select...

CVE-2026-63325

@redocly/respect-core and @redocly/cli (Redocly CLI) before version 2.33.0 contain an arbitrary code execution vulnerability in the respect command. The root cause is dynamic evaluation of $faker runtime expressions in Arazzo descriptions: a crafted expression can traverse constructor , prototype...

CVE-2026-86071

CVE-2026-86071 affects Junrar , an open-source Java RAR archive library. Prior to version 7.6.1 , the LocalFolderExtractor class in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. The ro...