CVE-2026-108329

HighCVSS 8.8/10Last modified Nov 4, 2026

Description

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
TaniumThreat Response>= 4.9, < 4.9.476; >= 4.12, < 4.12.349; >= 4.17, < 4.17.327

References

Timeline

Published
Oct 27, 2026
Last modified
Nov 4, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-108336.4The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site ScriptCVE-2026-1083303.6Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.CVE-2026-1083313.3Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.CVE-2026-1083326.3Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.CVE-2026-1083332.5Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.CVE-2026-1083347.4A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whCVE-2026-1083359.1When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attacCVE-2026-1083369.1When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate foCVE-2026-1083377.4An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included inCVE-2026-108338Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authentiCVE-2026-108344.6The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before movinCVE-2026-108357.7The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions
CVE-2026-108329: High severity, CVSS 8.8 | Vulnix