Vulnerability intelligence, in plain language

blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale…

Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message…

NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated…

ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview…

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by…

RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of…

SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when…

emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as…

emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to…

RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted…

A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the…

A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API…

Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA…

A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of…

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute…

A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file…

An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH…

Tanium addressed a heap-based buffer overflow vulnerability in Deploy. CVE-2026-120775 is rated high (CVSS 7.2) and is classified as CWE-122.

Tanium addressed an improper access controls vulnerability in Discover. CVE-2026-116667 is rated medium (CVSS 4.2) and is classified as CWE-863.

Tanium addressed an information disclosure vulnerability in Discover. CVE-2026-116666 is rated medium (CVSS 4.3) and is classified as CWE-200.

Tanium addressed an uncontrolled resource consumption vulnerability in Discover. CVE-2026-116668 is rated medium (CVSS 4.3) and is classified as CWE-400.

Tanium addressed an improper access controls vulnerability in Discover. CVE-2026-116669 is rated medium (CVSS 6.5) and is classified as CWE-639.

Tanium addressed a business logic error in Threat Response. CVE-2026-116652 is rated medium (CVSS 4.3) and is classified as CWE-628.

Tanium addressed an information disclosure vulnerability in Discover. CVE-2026-116665 is rated medium (CVSS 4.3) and is classified as CWE-200.