CVE-2026-108327

MediumCVSS 5.0/10Last modified Nov 6, 2026

Description

Tanium addressed a path traversal vulnerability in Tanium Data Service.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
TaniumTanium Data Service>= 4.1, < 4.1.281; >= 4.2, < 4.2.360
TaniumInteract>= 3.5.0, < 3.5.141

References

Timeline

Published
Nov 3, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1083284.2Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response.CVE-2026-1083298.8Tanium addressed an unauthorized code execution vulnerability in Threat Response.CVE-2026-108336.4The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site ScriptCVE-2026-1083303.6Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.CVE-2026-1083313.3Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.CVE-2026-1083326.3Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.CVE-2026-1083332.5Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.CVE-2026-1083347.4A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whCVE-2026-1083359.1When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attacCVE-2026-1083369.1When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate foCVE-2026-1083377.4An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included inCVE-2026-108338Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenti
CVE-2026-108327: Medium severity, CVSS 5.0 | Vulnix