| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0. |
| Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor entry, Cosign verifies the Rekor entry signature, and also compares the artifact's digest, the user's public key from either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious actor that has compromised a user's identity or signing key could construct a valid Cosign bundle by including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event. This issue has been patched in versions 2.6.2 and 3.0.4. |
| MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0. |
| React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0. |
| Tanium addressed an improper certificate validation vulnerability in Tanium Appliance. |
| Tanium addressed an improper input validation vulnerability in Discover. |
| Tanium addressed an improper access controls vulnerability in Patch. |
| Tanium addressed an incorrect default permissions vulnerability in Patch. |
| Tanium addressed an improper access controls vulnerability in Deploy. |
| Tanium addressed an incorrect default permissions vulnerability in Performance. |
| Tanium addressed an improper access controls vulnerability in Reputation. |
| Tanium addressed an improper link resolution before file access vulnerability in Enforce. |
| Tanium addressed an information disclosure vulnerability in Threat Response. |
| Tanium addressed an improper input validation vulnerability in Deploy. |
| Tanium addressed an uncontrolled resource consumption vulnerability in Connect. |
| Tanium addressed an incorrect default permissions vulnerability in Enforce. |
| Tanium addressed an improper output sanitization vulnerability in Tanium Appliance. |
| Tanium addressed an improper access controls vulnerability in Interact. |
| Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance. |
| Tanium addressed a documentation issue in Engage. |
