Live › vulnerability › CVE-2026-110265
A crafted malformed search query in runZero's hosted service could return results belonging to a different organization than the user's own. The sources report log analysis found only testing of the issue and no adversary traffic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
The issue is in runZero's hosted environment, where search results could cross organization boundaries. Teams that use runZero's hosted service are the ones to look at; the sources do not say whether self-hosted deployments are affected.
No product ranges from the sources yet.
Unknown from the sources.
5.1.261013.1 per the source; the hosted environment is reported as the affected productEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic. This issue was fixed in version 5.1.261013.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-110265")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.