CVE-2026-111107

Fireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of Service

A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device. Traffic processing is not affected.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-109823

Host filesystem path disclosure via DNS rebinding

An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout. This issue affects tidewave: from 0.8.0 before 0.9.2.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Tidewave-ai

Products

Tidewave

CVE-2026-109090

libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow

A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

X.org

Products

Libxi

CVE-2026-109089

libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow

A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

X.org

Products

Libxi

CVE-2026-108333

Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.

Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Endpoint Configuration Toolset Solution Threat Response

CVE-2026-108332

Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.

Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Endpoint Configuration Toolset Solution Threat Response

CVE-2026-108331

Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.

Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Endpoint Configuration Toolset Solution Threat Response

CVE-2026-108330

Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.

Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Endpoint Configuration Toolset Solution Threat Response

CVE-2026-108329

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Threat Response

CVE-2026-108328

Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response.

Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Threat Response

CVE-2026-108326

Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.

Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Cx-stream Endpoint Configuration Toolset Solution

CVE-2026-108325

Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.

Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Reputation

CVE-2026-108316

Tanium addressed an information disclosure vulnerability in Tanium Server.

Tanium addressed an information disclosure vulnerability in Tanium Server.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Tanium Server

CVE-2026-108310

Tanium addressed a denial of service vulnerability in Tanium Server.

Tanium addressed a denial of service vulnerability in Tanium Server.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Tanium Server

CVE-2026-108307

Tanium addressed a heap-based buffer overflow vulnerability in Index.

Tanium addressed a heap-based buffer overflow vulnerability in Index.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Endpoint Configuration Toolset Solution Index-cx

CVE-2026-108306

Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

End-user-cx Endpoint Configuration Toolset Solution

CVE-2026-108305

Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

End-user-cx Endpoint Configuration Toolset Solution

CVE-2026-108303

Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.

Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Certificate Manager

CVE-2026-108302

Tanium addressed an improper access controls vulnerability in Comply.

Tanium addressed an improper access controls vulnerability in Comply.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply

CVE-2026-108301

Tanium addressed an improper access controls vulnerability in Comply.

Tanium addressed an improper access controls vulnerability in Comply.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply