{"id":"CVE-2026-110265","title":"runZero search SQL injection","summary":"A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic. This issue was fixed in version 5.…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-89"],"vendor":"runZero","product":"Platform","affected":["Platform < 5.1.261013.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T18:07:43.904029Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T18:07:55.844Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110265","references":[{"url":"https://www.runzero.com/advisories/runzero-search-sqli-cve-2026-110265"},{"url":"https://help.runzero.com/docs/release-notes/#512610131"}],"tags":["cve.org"],"epss":0.00343,"epssPercentile":0.27973,"ingestedAt":"2026-11-05T20:33:06.338Z","slug":"CVE-2026-110265","body":"## Overview\n\nA specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic. This issue was fixed in version 5.1.261013.1.\n\n## Affected\n\n- `Platform < 5.1.261013.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}