Archive
5 February 2026
Vulnerabilities first published on this day (UTC), newest first.
62 results · Clear filters · Feed
-
Medium 5.3
Collabora Online vulnerable to Authorization Bypass
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to Collabora Online Development Edition version 25.04.08.2 and prior to Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5, a user with view-only right…
-
Medium 6.5
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
-
Medium 4.3
WeKan REST Endpoint boards.js BoardTitleRESTBleed access control
A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipulation causes improper access controls. Remote exploitation of the attack is possible. Upgrading to ve…
-
Medium 6.3
WeKan Attachment Storage attachments.js MoveStorageBleed access control
A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The manipulation results in improper access controls. The attack may be launched remotely. Upgrading to vers…
-
Medium 6.3
WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control
A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Attachment Migration. The manipulation leads to improper access controls. The attack may be initiated re…
-
Medium 5.3
Truncated 802.15.4 packet leads to denial of service
A truncated 802.15.4 packet can lead to an assert, resulting in a denial of service.
-
Medium 6.8
Out-of-bounds Write in o6 Automation GmbH Open62541
In builds with PubSub and JSON enabled, a crafted JSON message can cause the decoder to write beyond a heap-allocated array before authentication, reliably crashing the process and corrupting memory.
-
Medium 6.6
Tanium addressed an improper output sanitization vulnerability in TanOS.
Tanium addressed an improper output sanitization vulnerability in Tanium Appliance.
-
Medium 6.6
Tanium addressed a local privilege escalation vulnerability in Engage.
Tanium addressed a documentation issue in Engage.
-
Medium 6.3
Tanium addressed an improper input validation vulnerability in Discover.
Tanium addressed an improper input validation vulnerability in Discover.
-
Medium 4.3
Tanium addressed an improper access controls vulnerability in Patch.
Tanium addressed an improper access controls vulnerability in Patch.
-
Medium 4.3
Tanium addressed an improper access controls vulnerability in Deploy.
Tanium addressed an improper access controls vulnerability in Deploy.
-
Medium 5.0
Tanium addressed an improper link resolution before file access vulnerability in Enforce.
Tanium addressed an improper link resolution before file access vulnerability in Enforce.
-
Medium 4.3
Tanium addressed an uncontrolled resource consumption vulnerability in Connect.
Tanium addressed an uncontrolled resource consumption vulnerability in Connect.
-
Medium 4.9
Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
-
Medium 4.9
Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
-
Medium 4.3
Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
-
Medium 4.3
Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
-
Medium 4.3
Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Benchmark.
Tanium addressed an incorrect default permissions vulnerability in Benchmark.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Discover.
Tanium addressed an incorrect default permissions vulnerability in Discover.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Comply.
Tanium addressed an incorrect default permissions vulnerability in Comply.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Patch.
Tanium addressed an incorrect default permissions vulnerability in Patch.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Partner Integration.
Tanium addressed an incorrect default permissions vulnerability in Partner Integration.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Performance.
Tanium addressed an incorrect default permissions vulnerability in Performance.
-
Medium 4.3
Tanium addressed an improper access controls vulnerability in Reputation.
Tanium addressed an improper access controls vulnerability in Reputation.
-
Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Enforce.
Tanium addressed an incorrect default permissions vulnerability in Enforce.
-
Medium 5.3
Infinite parsing loop in golang.org/x/net
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
-
Medium 5.3
Quadratic parsing complexity in golang.org/x/net/html
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
-
Medium 5.9
LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N
The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check. Attackers can exploit this vulnerability via a Man-in-the-Mi…
-
Medium 5.1
PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)
PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This…
-
Medium 4.3
HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)
HRSALE 1.1.8 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized administrative users through the employee registration form. Attackers can craft a malicious HTML page with hidden form fields to trick authenticated ad…
-
Medium 5.3
Exagate Sysguard 6001 - Cross-Site Request Forgery (Add Admin)
Exagate SYSGuard 6001 contains a cross-site request forgery vulnerability that allows attackers to create unauthorized admin accounts through a crafted HTML form. Attackers can trick users into submitting a malicious form to /kulyon.php that adds a new user w…
-
Medium 5.5
Everest 5.50.2100 - 'Open File' Denial of Service
Everest, later referred to as AIDA64, 5.50.2100 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating file open functionality. Attackers can generate a 450-byte buffer of repeated characters and paste …
-
Medium 6.1
PHP-Fusion 9.03.50 - 'panels.php' Eval Injection
PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code through an eval() function with unsanitized POST data. Attackers can exploit the vulnerability by sending craf…
-
Medium 6.2
Product Key Explorer 4.2.2.0 - 'Key' Denial of Service
Nsauditor Product Key Explorer 4.2.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by inputting a specially crafted registration key. Attackers can generate a payload of 1000 bytes of repeated characters and…
-
Medium 6.2
UltraVNC Launcher 1.2.4.0 - 'Password' Denial of Service
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration properties that allows local attackers to crash the application. Attackers can paste an overly long 300-character string into the password field to trigger an a…
-
Medium 6.2
ZOC Terminal 7.25.5 - 'Script' Denial of Service
ZOC Terminal 7.25.5 contains a script processing vulnerability that allows local attackers to crash the application by loading a maliciously crafted REXX script file. Attackers can generate an oversized script with 20,000 repeated characters to trigger an app…
-
Medium 5.5
dnsmasq-utils 2.79-1 - 'dhcp_release' Denial of Service
Dnsmasq-utils 2.79-1 contains a buffer overflow vulnerability in the dhcp_release utility that allows attackers to cause a denial of service by supplying excessive input. Attackers can trigger a core dump and terminate the dhcp_release process by sending a cr…
-
Medium 5.5
CODE::BLOCKS 16.01 - Buffer Overflow (SEH) UNICODE
CODE::BLOCKS 16.01 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler with crafted Unicode characters. Attackers can create a malicious text file with 1982 bytes of buffer and s…