CVE-2026-2435

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Tanium addressed a SQL injection vulnerability in Asset.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-243505.4PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file containing a maliciCVE-2026-243515.4PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML andCVE-2026-243529.8PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authenticatCVE-2026-243534.3Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access ControlCVE-2026-243546.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Shortcodes & PerformCVE-2026-243556.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - FunctionalitCVE-2026-243564.9Missing Authorization vulnerability in Roxnor GetGenie getgenie allows Exploiting Incorrectly Configured Access Control Security Levels.ThisCVE-2026-243574.3Missing Authorization vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Exploiting Incorrectly Configured Access Control SecuriCVE-2026-243584.3Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured CVE-2026-243598.8Authentication Bypass Using an Alternate Path or Channel vulnerability in Dokan, Inc. Dokan dokan-lite allows Authentication Abuse.This issuCVE-2026-24368.2A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()CVE-2026-243604.4Server-Side Request Forgery (SSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Server Side
CVE-2026-2435: High severity, CVSS 8.8 | Vulnix