Runzero - vulnerabilities (CVEs)

14 CVEs in 3 products, 0 in the last 30 days, newest from 2026-09-01.

Products

Platform - 13 CVEs
Runzero Platform - 12 CVEs
Explorer - 1 CVEs

Newest CVEs of Runzero

CVE-2026-81846 - CVSS 3.5 (low), 2026-09-01: An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization…
CVE-2026-7778 - CVSS 5 (medium), 2026-05-05: An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved. This is an instance of…
CVE-2026-5380 - CVSS 5.3 (medium), 2026-04-07: An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved. This is an instance…
CVE-2026-5384 - CVSS 5.8 (medium), 2026-04-07: An issue that could allow a credential to be updated and used for a task from outside of the authorized organization scope has been resolved. This is an…
CVE-2026-5382 - CVSS 3 (low), 2026-04-07: An issue that could expose records outside of the authorized organization scope through the MCP endpoints has been resolved. This is an instance of CWE-863:…
CVE-2026-5383 - CVSS 4.4 (medium), 2026-04-07: An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved. This is an instance of CWE-863:…
CVE-2026-5381 - CVSS 2.2 (low), 2026-04-07: An issue that could expose task information outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect…
CVE-2026-5376 - CVSS 5.9 (medium), 2026-04-07: An issue that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolved. This is an instance of CWE-613:…
CVE-2026-5375 - CVSS 2.7 (low), 2026-04-07: An issue that could allow a user with access to a credential to view sensitive fields through an API response has been resolved. This is an instance of…
CVE-2026-5379 - CVSS 3 (low), 2026-04-07: An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved. This is an instance…
CVE-2026-5374 - CVSS 5.8 (medium), 2026-04-07: An issue that allowed MCP agents to access remediation and asset information from outside of the authorized organization scope has been resolved. This is an…
CVE-2026-5378 - CVSS 6.8 (medium), 2026-04-07: An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved. This is an instance of…
CVE-2026-5373 - CVSS 8.4 (high), 2026-04-07: An issue that allowed all-organization administrators to promote accounts to superuser status has been resolved. This is an instance of CWE-269: Improper…
CVE-2026-5372 - CVSS 6.4 (medium), 2026-04-07: An issue that allowed a SQL injection attack vector related to saved queries (introduced in version 4.0.260123.0). This is an instance of CWE-89: Improper…