CVE-2026-108304 is a local privilege escalation vulnerability in the Tanium Endpoint Configuration Toolset Solution affecting End-User Notifications. The flaw involves improper link resolution before file access, also known as 'link following'. Tanium has addressed this vulnerability in multiple fixed versions. The vulnerability has a high severity with a CVSS score of 7.8.
CVE-2026-87086 is a denial of service vulnerability in Tanium Provision caused by an unchecked return value leading to a NULL pointer dereference. This flaw can cause the affected software to crash or become unavailable. Tanium has released fixes in versions 1.17.150, 1.23.161, and 1.24.199 to address this issue.
CVE-2026-108309 is a vulnerability in the Tanium Endpoint Configuration Toolset Solution's Performance Client Extension that allows uncontrolled resource consumption due to lack of limits or throttling. This can lead to denial of service conditions by exhausting system resources. Tanium has released fixes for multiple affected versions to address this issue.
CVE-2026-116658 is a denial of service vulnerability in Tanium Enforce caused by a NULL pointer dereference. It affects versions 2.9 up to but not including 2.9.736, 2.10 up to but not including 2.10.778, and 3.0 up to but not including 3.0.373. The vulnerability has been fixed in versions 2.9.736, 2.10.778, and 3.0.373. The CVSS v3.1 base score is 6.5, indicating a medium severity impact, with no confidentiality or integrity impact but a high impact on availability.
CVE-2026-108313 is a vulnerability in Tanium Server involving improper handling of case sensitivity that leads to incorrect privilege assignment. This flaw could allow an attacker with high privileges to gain unauthorized access or perform unauthorized actions. Tanium has addressed this issue in specific fixed versions.
CVE-2026-116649 is a high-severity vulnerability in Tanium Enforce involving improper neutralization of formula elements in CSV files. This flaw relates to insufficient output sanitization, which could allow an attacker to inject malicious formulas into CSV exports. Tanium has addressed this issue in versions 2.9.736, 2.10.778, and 3.0.373.
CVE-2026-116647 is a vulnerability in Tanium Comply involving improper neutralization of formula elements in CSV files, which could lead to security issues when processing such files. Tanium has addressed this flaw in versions 2.32.263, 2.35.323, and 2.37.326. The vulnerability has a high severity rating with a CVSS score of 7.1.
CVE-2026-116660 is a medium severity vulnerability in Tanium Enforce involving missing authorization controls. It allows improper access due to insufficient access control mechanisms. The issue affects versions 2.9 prior to 2.9.736, 2.10 prior to 2.10.778, and 3.0 prior to 3.0.373. Tanium has addressed this vulnerability in the fixed versions 2.9.736, 2.10.778, and 3.0.373.
CVE-2026-108326 is an improper certificate validation vulnerability in the Tanium Endpoint Configuration Toolset Solution's Stream Client Extension. This flaw could allow an attacker to exploit the certificate validation process. Tanium has released fixes for multiple affected versions to address this issue. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
CVE-2026-108330 is an information disclosure vulnerability in the Tanium Endpoint Configuration Toolset Solution's Threat Response Client Extension. It involves an out-of-bounds read that could potentially expose sensitive information. The issue affects multiple versions prior to fixed releases. Tanium has addressed this vulnerability in versions 1.71.25, 1.59.50, 1.51.60, 1.21.1673, 1.20.2271, 1.19.2213, 1.18.2732, and 1.17.802. The CVSS score is 3.6, indicating a low severity impact with limited confidentiality loss and no integrity or availability impact.
CVE-2026-116657 is a denial of service vulnerability in Tanium Enforce caused by allocation of resources without limits or throttling. This flaw could allow an unauthenticated remote attacker to exhaust system resources, leading to service disruption. Tanium has addressed this issue in versions 2.9.736, 2.10.778, and 3.0.373.
A use-after-free vulnerability was identified and addressed in the Tanium Endpoint Configuration Toolset Solution's Threat Response Client Extension. This flaw could potentially lead to a denial of service condition due to application crashes. The vulnerability has a low severity rating and does not impact confidentiality or integrity. Multiple versions prior to the fixed releases are affected.
A heap-based buffer overflow vulnerability exists in the Tanium Endpoint Configuration Toolset Solution. This flaw affects multiple versions prior to fixed releases and can lead to high-impact consequences including confidentiality, integrity, and availability compromises. Tanium has addressed this vulnerability in specific patched versions.
Neko versions from 3.0.0 up to but not including 3.1.5 have an incorrect authorization vulnerability in legacy mode with session.implicit_hosting enabled. This flaw allows authenticated room members to send mouse and keyboard events via the legacy WebRTC data channel even when controls are locked or the member is unauthorized by the modern control API. The issue is fixed in version 3.1.5.
A denial of service vulnerability exists in Tanium Server due to allocation of resources without limits or throttling. This flaw can cause the server to become unavailable by exhausting resources. Tanium has addressed this issue in specific fixed versions.
CVE-2026-116662 is a high-severity vulnerability in Tanium Enforce involving improper handling of highly compressed data, also known as a compression bomb. This flaw can cause a denial of service by amplifying data processing requirements. Tanium has fixed this issue in versions 2.9.736, 2.10.778, and 3.0.373.
CVE-2026-108305 is a local privilege escalation vulnerability in the Tanium Endpoint Configuration Toolset Solution affecting End-User Notifications. It involves improper link resolution before file access, also known as 'link following'. The vulnerability has a high severity with a CVSS score of 7.8 and impacts confidentiality, integrity, and availability. Tanium has released fixed versions to address this issue.
CVE-2026-108331 is an infinite loop vulnerability in the Tanium Endpoint Configuration Toolset Solution's Threat Response Client Extension. This flaw can cause uncontrolled recursion leading to a denial of service condition. Tanium has addressed this issue in fixed versions.
CVE-2026-87085 is a SQL injection vulnerability in Tanium Provision that allows improper neutralization of special elements used in SQL commands. This flaw was addressed by Tanium in versions 1.17.150, 1.23.161, and 1.24.199. The vulnerability has a medium severity with a CVSS score of 6.5, indicating it requires low privileges to exploit and can impact confidentiality, integrity, and availability to a limited extent.
A SQL injection vulnerability was identified and addressed in Tanium Patch. This flaw involves improper neutralization of special elements in SQL commands, potentially allowing an attacker with low privileges to cause a high-impact confidentiality breach. The vulnerability affects multiple versions prior to specific fixed releases.