CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,438 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,438
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product runzero:runzero_platform. Show all products

12 CVEs, showing 1 to 12
CVESeverityTitlePublished
CVE-2026-5384Medium 5.8An issue that could allow a credential to be updated and used for a task from outside of the authorized organization scope has been resolved.Apr 7, 2026
CVE-2026-5383Medium 4.4An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved.Apr 7, 2026
CVE-2026-5382Low 3.0An issue that could expose records outside of the authorized organization scope through the MCP endpoints has been resolved.Apr 7, 2026
CVE-2026-5381Low 2.2An issue that could expose task information outside of the authorized organization scope has been resolved.Apr 7, 2026
CVE-2026-5380Medium 5.3An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved.Apr 7, 2026
CVE-2026-5379Low 3.0An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved.Apr 7, 2026
CVE-2026-5378Medium 6.8An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved.Apr 7, 2026
CVE-2026-5376Medium 5.9An issue that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolved.Apr 7, 2026
CVE-2026-5375Low 2.7An issue that could allow a user with access to a credential to view sensitive fields through an API response has been resolved.Apr 7, 2026
CVE-2026-5374Medium 5.8An issue that allowed MCP agents to access remediation and asset information from outside of the authorized organization scope has been resolved.Apr 7, 2026
CVE-2026-5373High 8.4An issue that allowed all-organization administrators to promote accounts to superuser status has been resolved.Apr 7, 2026
CVE-2026-5372Medium 6.4An issue that allowed a SQL injection attack vector related to saved queries (introduced in version 4.0.260123.0).Apr 7, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.