Vulnerabilities

TI-2026-04707 CVE-2026-5379 · GHSA-pqp2-x3gp-9g37

runZero Platform MCP certification information leak

LOW 14

An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved.

CVSS 3.1LOW 3.0 Network High privileges No interaction EPSS 0.0012 Published 2026-04-07 Fixed in 4.0.260203.0 CWE-863

TI-2026-04706 CVE-2026-5378 · GHSA-v27j-88v5-qwrq

LOW 29

An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00195 Published 2026-04-07 Fixed in 4.0.260203.0 CWE-863

TI-2026-04704 CVE-2026-5376 · GHSA-gf6w-7f3p-cmx4

LOW 28

An issue that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolved.

CVSS 3.1MEDIUM 5.9 Network High privileges No interaction EPSS 0.00216 Published 2026-04-07 Fixed in 4.0.260203.0 CWE-613

TI-2026-04703 CVE-2026-5375 · GHSA-5fhv-ppcw-vh7h

LOW 13

An issue that could allow a user with access to a credential to view sensitive fields through an API response has been resolved.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00204 Published 2026-04-07 Fixed in 4.0.260203.0 CWE-200