Export limit exceeded: 419502 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419502 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108333 | 1 Tanium | 2 Endpoint Configuration Toolset Solution, Threat Response | 2026-11-04 | 2.5 Low |
| Tanium addressed a use-after-free vulnerability in Threat Response Client Extension. | ||||
| CVE-2026-108332 | 1 Tanium | 2 Endpoint Configuration Toolset Solution, Threat Response | 2026-11-04 | 6.3 Medium |
| Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension. | ||||
| CVE-2026-108331 | 1 Tanium | 2 Endpoint Configuration Toolset Solution, Threat Response | 2026-11-04 | 3.3 Low |
| Tanium addressed an infinite loop vulnerability in Threat Response Client Extension. | ||||
| CVE-2026-108330 | 1 Tanium | 2 Endpoint Configuration Toolset Solution, Threat Response | 2026-11-04 | 3.6 Low |
| Tanium addressed an information disclosure vulnerability in Threat Response Client Extension. | ||||
| CVE-2026-108329 | 1 Tanium | 1 Threat Response | 2026-11-04 | 8.8 High |
| Tanium addressed an unauthorized code execution vulnerability in Threat Response. | ||||
| CVE-2026-108328 | 1 Tanium | 1 Threat Response | 2026-11-04 | 4.2 Medium |
| Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response. | ||||
| CVE-2026-108326 | 1 Tanium | 2 Cx-stream, Endpoint Configuration Toolset Solution | 2026-11-04 | 6.5 Medium |
| Tanium addressed an improper certificate validation vulnerability in Stream Client Extension. | ||||
| CVE-2026-108325 | 1 Tanium | 1 Reputation | 2026-11-04 | 6.6 Medium |
| Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation. | ||||
| CVE-2026-108316 | 1 Tanium | 1 Tanium Server | 2026-11-04 | 4.3 Medium |
| Tanium addressed an information disclosure vulnerability in Tanium Server. | ||||
| CVE-2026-108310 | 1 Tanium | 1 Tanium Server | 2026-11-04 | 5.3 Medium |
| Tanium addressed a denial of service vulnerability in Tanium Server. | ||||
| CVE-2026-108307 | 1 Tanium | 2 Endpoint Configuration Toolset Solution, Index-cx | 2026-11-04 | 7.8 High |
| Tanium addressed a heap-based buffer overflow vulnerability in Index. | ||||
| CVE-2026-108306 | 1 Tanium | 2 End-user-cx, Endpoint Configuration Toolset Solution | 2026-11-04 | 7.8 High |
| Tanium addressed a local privilege escalation vulnerability in End-User Notifications. | ||||
| CVE-2026-108305 | 1 Tanium | 2 End-user-cx, Endpoint Configuration Toolset Solution | 2026-11-04 | 7.8 High |
| Tanium addressed a local privilege escalation vulnerability in End-User Notifications. | ||||
| CVE-2026-108303 | 1 Tanium | 1 Certificate Manager | 2026-11-04 | 8.8 High |
| Tanium addressed an unauthorized code execution vulnerability in Certificate Manager. | ||||
| CVE-2026-108302 | 1 Tanium | 1 Comply | 2026-11-04 | 4.3 Medium |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-108301 | 1 Tanium | 1 Comply | 2026-11-04 | 6 Medium |
| Tanium addressed an improper access controls vulnerability in Comply. | ||||
| CVE-2026-108015 | 1 Hcltech | 1 Notes | 2026-11-04 | N/A |
| Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections. | ||||
| CVE-2026-107590 | 1 Qt | 3 Qt, Qt5compat, Qtbase | 2026-11-04 | N/A |
| An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and may affect data integrity. | ||||
| CVE-2026-104895 | 2026-11-04 | 7.5 High | ||
| The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately. A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread. This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required. | ||||
| CVE-2026-104016 | 2026-11-04 | 7.5 High | ||
| ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and _finishShortText(len) reaches TextBuffer.expandCurrentSegment(len), which performs Arrays.copyOf with no cap and throws OutOfMemoryError: Requested array size exceeds VM limit. The JVM refuses arrays larger than Integer.MAX_VALUE - 8 before consulting available heap, so -Xmx tuning does not mitigate the issue. StreamReadConstraints.maxStringLength and maxDocumentLength do not gate this path: a 33-byte payload is far below any document-length cap and the string-length check does not fire before the allocation. This was confirmed empirically against shipping artifacts with maxStringLength, maxDocumentLength and maxNestingDepth all configured. A February 2026 hardening commit added the equivalent overflow guard to the packed-array-length and message-length paths but left the string-length call sites unguarded. No privileges or user interaction beyond the ability to submit data for parsing are required. | ||||