First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-75476

LowCVSS 3.1/10Last modified Sep 1, 2026

Description

Tanium addressed a compression bomb vulnerability in Threat Response.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Tanium	Threat Response	>= 4.9, < 4.9.437; >= 4.12, < 4.12.308; >= 4.17, < 4.17.277

References

https://security.tanium.com/TAN-2026-021

Timeline

Published: Aug 19, 2026
Last modified: Sep 1, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-754797.5JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attack CVE-2026-75488.8A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cg CVE-2026-754806.5OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticat CVE-2026-754818.8SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Att CVE-2026-754827.5SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory dir CVE-2026-754833.3powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers CVE-2026-754846.9Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to sm CVE-2026-754855.5A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in r CVE-2026-754868.0Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuratio CVE-2026-75497.3A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?acti CVE-2026-754967.2Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible CVE-2026-754977.2Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges

CVE-2026-75476: Low severity, CVSS 3.1 | Vulnix