First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-11617

LowCVSS 3.1/10Last modified Sep 1, 2026

Description

Tanium addressed a compression bomb vulnerability in Findings.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Tanium	Findings	>= 1.2, < 1.2.95; >= 1.4, < 1.4.105

References

https://security.tanium.com/TAN-2026-020

Timeline

Published: Aug 19, 2026
Last modified: Sep 1, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-1161704.9SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op an CVE-2026-1161714.4SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix CVE-2026-1161727.5vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers t CVE-2026-1161737.5vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing CVE-2026-1161747.5vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that CVE-2026-1161756.5vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without CVE-2026-1161768.2vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by CVE-2026-1161777.5vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust CVE-2026-1161787.5vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending incons CVE-2026-1161797.5vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap CVE-2026-116187.3A vulnerability was determined in DTStack Taier up to 1.4.0. The affected element is the function preHandle of the file taier-data-develop/s CVE-2026-1161807.7vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int

CVE-2026-11617: Low severity, CVSS 3.1 | Vulnix