Tanium fixed a medium-severity vulnerability in its Discover product related to improper access controls. The flaw could allow an attacker with low privileges to gain limited unauthorized access, impacting confidentiality and integrity but not availability. No known exploits or patches are currently documented.
Tanium has addressed a vulnerability in its Discover product related to improper access controls. This flaw could allow an attacker with limited privileges to access sensitive information. The vulnerability has a medium severity rating with a CVSS score of 6.5. No specific affected versions or patch details are provided in the available data.
An information disclosure vulnerability was addressed by Tanium in its Discover product. The vulnerability could allow an attacker with low privileges to gain limited access to information. The issue has a medium severity rating with a CVSS score of 4.3. No specific affected versions or patch details are provided in the available data.
A medium-severity vulnerability (CVE-2026-116668) in Tanium Discover allows uncontrolled resource consumption, potentially leading to denial of service conditions. The flaw does not impact confidentiality or integrity but affects availability. No affected versions or patch information are provided.
A heap-based buffer overflow vulnerability was identified and addressed in Tanium Deploy. This vulnerability could allow an attacker with high privileges to execute arbitrary code, resulting in complete compromise of confidentiality, integrity, and availability of the affected system.
Tanium Threat Response contains a high-severity vulnerability (CVE-2026-116650) that allows unauthorized code execution. This flaw could enable an attacker with limited privileges to execute arbitrary code remotely, impacting confidentiality, integrity, and availability. The vulnerability is identified as CWE-78 (OS Command Injection).
A denial of service vulnerability was identified and addressed in the Tanium Client. The vulnerability allows an attacker to cause a denial of service condition without requiring privileges or user interaction.
A business logic error was identified and addressed in Tanium Threat Response. This vulnerability has a medium severity rating with a CVSS score of 4.3. It does not impact confidentiality or availability but can affect integrity. No affected versions or patch details are provided.
Tanium Enforce contains an improper access controls vulnerability (CVE-2026-116661) that could allow an attacker with limited privileges to cause a high impact on integrity. The vulnerability has a CVSS score of 6.5, indicating a medium severity. No specific affected versions or patch information are provided.
CVE-2026-116648 is an improper output sanitization vulnerability in Tanium Discover. It has a medium severity with a CVSS score of 4.1. The flaw could lead to a partial impact on availability but does not affect confidentiality or integrity. No affected versions or patch information are provided.
Tanium Enforce contains an improper access controls vulnerability identified as CVE-2026-116663. This flaw allows an attacker with low privileges to gain unauthorized read access to sensitive information. The vulnerability does not impact integrity or availability. It has a medium severity rating with a CVSS score of 6.5.
An improper input validation vulnerability was identified and addressed in Tanium Threat Response. The flaw could allow an attacker with low privileges to cause limited integrity impact without user interaction. The vulnerability has a medium severity rating with a CVSS score of 4.3.
A path traversal vulnerability was identified and addressed in Tanium Data Service. This vulnerability could allow an attacker with high privileges to cause integrity impact and low availability impact. The vulnerability has a medium severity rating and no known exploits in the wild have been reported.
A medium severity vulnerability (CVE-2026-116646) in Tanium Threat Response involves uncontrolled resource consumption. This flaw does not impact confidentiality or integrity but can affect availability by exhausting resources. No specific affected versions or patch information is provided.
Tanium Threat Response contained an unauthorized code execution vulnerability identified as CVE-2026-116651. This vulnerability could allow an attacker with low privileges to execute code remotely under certain conditions. The flaw has been assigned a high severity score of 7.5, reflecting its potential impact on confidentiality, integrity, and availability. No specific affected versions or patch information is provided in the available data.
The Core Temp kernel driver by ALCPU has an insufficient access control vulnerability in an exposed IOCTL interface. This flaw may allow an attacker with physical access to read or write physical memory, potentially leading to full system compromise. The vulnerability has a CVSS score of 6.7, indicating a medium severity level.
A remote code execution vulnerability (CVE-2026-104608) was found in GitHub Enterprise Server's Git service component (babeld). The flaw involves a use-after-free condition triggered by re-entrant callbacks modifying internal collections during SSH operations. An attacker with an account and SSH access could exploit this to execute arbitrary commands as the babeld process and disclose environment secrets. Exploitation requires per-build memory offsets and failed attempts cause crashes. The issue affects all versions prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14.
An improper input validation vulnerability was identified and addressed in Tanium Threat Response. The flaw could allow an attacker with low privileges to cause a high impact on confidentiality without user interaction. The vulnerability has a medium severity rating with a CVSS score of 6.5. No specific affected versions or patch details are provided.
A cross-site request forgery (CSRF) vulnerability in GitHub Enterprise Server prior to version 3.23 allowed unauthenticated attackers to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials. Exploitation required an authenticated Management Console operator to visit attacker-controlled content, which would trigger a cross-site GET request lacking a CSRF token to the integration removal endpoint. This could disrupt ChatOps notifications and commands when configurations were applied or services reloaded. The issue was fixed in versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3.
All versions of StorageGRID (formerly StorageGRID Webscale) in default and common configurations allow unauthenticated attackers to access a limited set of internal APIs intended for use within the grid. This vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.9. No specific affected versions or patches are currently documented. There is no evidence of exploitation in the wild at this time.