CVE Vulnerability Catalog

Tanium addressed an improper access controls vulnerability in Tanium Server.

Tanium addressed a path traversal vulnerability in Tanium Data Service.

The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting in all versions up to, and including, 3.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WP Event Solution (Eventin) plugin for WordPress up to version 4.1.22 has a missing authorization vulnerability in the REST endpoint /wp-json/eventin/v2/orders. The permission check only verifies a nonce that is leaked to every visitor and accepts a user-supplied 'status' value without validation. This allows unauthenticated attackers to create orders with status 'completed' that are counted as sold, exhausting ticket inventory.

Tor before version 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, allowing remote attackers to cause a denial of service (crash) due to corrupted congestion-control state. This is TROVE-2026-032.

In tile-ai tilelang up to version 0.1.14, there is a weakness in the function KernelCache._load_kernel_from_disk in the file tilelang/cache/kernel_cache.py. Manipulation can lead to deserialization, and the attack can be performed remotely. The fix has not been included in any official release yet.

An information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36. A remote attacker could bypass system access restrictions via a crafted HTML page.

Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36. A remote attacker leveraging social engineering could spoof UI elements via a crafted HTML page.

UI misrepresentation in FullScreen in Google Chrome on Windows prior to 153.0.8010.36. A remote attacker could spoof UI elements via a crafted HTML page.

Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36. A remote attacker could obtain cross-origin data via a crafted HTML page.

UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36. A remote attacker leveraging social engineering could bypass system access restrictions via a crafted HTML page.

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page.

Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page.

Out of bounds read in WebView in Google Chrome on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page.

UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Severity is medium.

Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Severity is medium.

Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. Severity is low.

Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Severity is medium.