An infinite loop vulnerability was identified and addressed in the Tanium Threat Response Client Extension. This flaw can cause a denial of service condition by making the affected component enter an endless processing loop.
Tanium fixed a vulnerability in its Stream Client Extension where improper certificate validation could allow an attacker to impact confidentiality. The flaw does not affect integrity but may cause limited availability issues. The vulnerability has a CVSS score of 6.5, indicating medium severity.
A SQL injection vulnerability was identified and addressed in Tanium Patch. This vulnerability could allow an attacker with low privileges to execute unauthorized SQL queries, potentially leading to high confidentiality impact without affecting integrity or availability.
Tanium Threat Response had a vulnerability allowing insertion of sensitive information into log files. This issue could lead to unauthorized disclosure of sensitive data through logs. The vulnerability has a medium severity score of 4.2 and requires high privileges and user interaction to exploit. No public exploits or known active exploitation have been reported. No affected versions or patch information are provided.
An incorrect privilege assignment vulnerability was identified and addressed in Tanium Server. The flaw could allow an attacker with high privileges to gain unauthorized access or perform unauthorized actions. The vulnerability has a CVSS score of 6.6, indicating a medium severity level.
A vulnerability in Tanium Reputation allows insertion of sensitive information into log files, potentially exposing confidential data. This issue has been assigned CVE-2026-108325 and carries a medium severity rating with a CVSS score of 6.6.
A denial of service vulnerability has been identified and addressed in Tanium Server. The vulnerability could allow an unauthenticated attacker to cause a denial of service condition, impacting availability. The issue is tracked as CVE-2026-108310 with a medium severity rating and a CVSS score of 5.3.
An information disclosure vulnerability was identified and addressed in Tanium Server. The vulnerability has a medium severity rating with a CVSS score of 4.3. It involves a flaw that could allow an attacker with low privileges to gain limited access to information without user interaction. No specific affected versions or patch details are provided.
A medium severity vulnerability (CVE-2026-108309) exists in Tanium's Performance Client Extension that allows uncontrolled resource consumption. This flaw does not impact confidentiality or integrity but can cause denial of service by exhausting resources. No affected versions or patch information are provided.
An insufficient logging vulnerability was identified and addressed in Tanium Server. This vulnerability relates to inadequate logging practices that could impact the integrity of logged information. The issue is assigned CVE-2026-108311 and has a low severity score of 2.7. No specific affected versions or patch details are provided in the available data.
A heap-based buffer overflow vulnerability was identified and addressed in Tanium's Index component. This vulnerability could allow an attacker with local privileges to execute arbitrary code or cause a denial of service. The flaw has been assigned CVE-2026-108307 and carries a high severity rating with a CVSS score of 7.8.
A local privilege escalation vulnerability was identified and addressed by Tanium in its End-User Notifications component. This vulnerability could allow a local attacker to gain elevated privileges on the affected system. The issue has a high severity rating with a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No specific affected versions or patch details are provided in the available data.
A local privilege escalation vulnerability was identified and addressed by Tanium in its End-User Notifications component. This vulnerability allows an attacker with local access to escalate privileges, potentially leading to full system compromise. The vulnerability is rated high severity with a CVSS score of 7.8. No specific affected versions or patch details are provided in the available data.
A vulnerability exists in TP-Link RE305 V3 and Archer C7 V5 devices where a hard-coded AES-128 cryptographic key and initialization vector are embedded in the firmware's configuration backup mechanism. This allows an attacker who obtains a backup file to decrypt it and access sensitive configuration data such as administrator passwords and Wi-Fi credentials.
CVE-2026-102815 is an operating-system command injection vulnerability in the tmpServer service of TP-Link RE305 V3. The vulnerable service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device can submit crafted requests to the TDDPv1 service to execute arbitrary OS commands with root privileges. This vulnerability allows privilege escalation from low-privileged user to root on the affected device.
Tanium Comply contains an improper access controls vulnerability identified as CVE-2026-108301. This flaw could allow an attacker with low privileges to cause partial compromise of confidentiality, integrity, and availability. The vulnerability has a medium severity rating with a CVSS score of 6. No specific affected versions or patch information is provided.
A high-severity vulnerability (CVE-2026-108303) in Tanium's Certificate Manager allows unauthorized code execution. The flaw has a CVSS score of 8.8, indicating it can be exploited remotely with low complexity and no user interaction. The vulnerability impacts confidentiality, integrity, and availability. No specific affected versions or patch information are provided.
A local privilege escalation vulnerability was identified and addressed by Tanium in its End-User Notifications component. This vulnerability allows a local attacker with limited privileges to escalate their privileges, potentially leading to full system compromise. The vulnerability is rated high severity with a CVSS score of 7.8. No specific affected versions or patch details are provided in the available data.
A medium-severity vulnerability (CVE-2026-108302) was identified in Tanium Comply involving improper access controls. This flaw could allow an attacker with low privileges to gain limited unauthorized read access. No known exploits are reported in the wild, and no patch or fixed versions have been specified.
An authentication flaw in the password-recovery functionality of TP-Link RE305 V3 allows an unauthenticated attacker on the same local network to generate and potentially brute-force an administrator password-reset verification code. The lack of an effective attempt counter or lockout mechanism combined with a predictable code generation process enables resetting the administrator password and gaining privileged device management access.