CVE-2026-87033

Tanium addressed an improper access controls vulnerability in Comply.

Tanium addressed an improper access controls vulnerability in Comply.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply

CVE-2026-87030

Tanium addressed a path traversal vulnerability in Comply.

Tanium addressed a path traversal vulnerability in Comply.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply

CVE-2026-87025

Tanium addressed an improper access controls vulnerability in Comply.

Tanium addressed an improper access controls vulnerability in Comply.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply

CVE-2026-87817

GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Gitpython-developers Gitpython Project

Products

Gitpython Gitpython

CVE-2026-87023

Tanium addressed a path traversal vulnerability in Comply.

Tanium addressed a path traversal vulnerability in Comply.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply

CVE-2026-87021

Tanium addressed an unauthorized code execution vulnerability in Comply.

Tanium addressed an unauthorized code execution vulnerability in Comply.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply

CVE-2026-61908

cyrus-imapd: cyrus-imapd: JMAP email-header blob ID out-of-bounds index

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Cyrus Cyrusimap

Products

Imap Cyrus Imap

CVE-2026-87019

Tanium addressed an improper access controls vulnerability in Comply.

Tanium addressed an improper access controls vulnerability in Comply.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply

CVE-2026-87047

Tanium addressed an improper access controls vulnerability in Comply.

Tanium addressed an improper access controls vulnerability in Comply.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply

CVE-2026-61909

cyrus-imapd: cyrus-imapd: CalDAV/CardDAV multiget bypasses per-href ACL

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Cyrus Cyrusimap

Products

Imap Cyrus Imap

CVE-2026-69413

Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability

Use after free in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-87046

Tanium addressed an improper access controls vulnerability in Comply.

Tanium addressed an improper access controls vulnerability in Comply.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply

CVE-2026-87037

Tanium addressed an improper access controls vulnerability in Comply.

Tanium addressed an improper access controls vulnerability in Comply.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply

CVE-2026-87036

Tanium addressed an improper access controls vulnerability in Comply.

Tanium addressed an improper access controls vulnerability in Comply.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply

CVE-2026-87035

Tanium addressed an information disclosure vulnerability in Comply.

Tanium addressed an information disclosure vulnerability in Comply.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply

CVE-2026-61910

cyrus-imapd: cyrus-imapd: Mailbox/set let sharee change special-use role on shared mailboxes

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Cyrus Cyrusimap

Products

Imap Cyrus Imap

CVE-2026-61911

cyrus-imapd: cyrus-imapd: Sieve fileinto mailbox existence oracle

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cyrus Cyrusimap

Products

Imap Cyrus Imap

CVE-2026-61915

cyrus-imapd: cyrus-imapd: VPATCH BYPARAM double-free in CalDAV

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Cyrus Cyrusimap

Products

Imap Cyrus Imap

CVE-2026-87034

Tanium addressed a SQL injection vulnerability in Comply.

Tanium addressed a SQL injection vulnerability in Comply.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Comply

CVE-2026-69343

Windows Overlay Filter Information Disclosure Vulnerability

Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 22 more