First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-108328

MediumCVSS 4.2/10Last modified Nov 4, 2026

Description

Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Tanium	Threat Response	>= 4.9, < 4.9.476; >= 4.12, < 4.12.349; >= 4.17, < 4.17.327

References

https://security.tanium.com/TAN-2026-051

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-1083298.8Tanium addressed an unauthorized code execution vulnerability in Threat Response.CVE-2026-108336.4The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Script CVE-2026-1083303.6Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.CVE-2026-1083313.3Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.CVE-2026-1083326.3Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.CVE-2026-1083332.5Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.CVE-2026-1083347.4A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines wh CVE-2026-1083359.1When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attac CVE-2026-1083369.1When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate fo CVE-2026-1083377.4An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in CVE-2026-108338Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenti CVE-2026-108344.6The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before movin

CVE-2026-108328: Medium severity, CVSS 4.2 | Vulnix