Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
Description: Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim’s Sentry account, source repository, or infrastructure.
The CVSS Base Score is a score from 0 to 10 that represents the intrinsic severity of a vulnerability. A higher score indicates greater severity.
Database CWE: v4.18
CWE-20: Improper Input Validation ↗
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94: Improper Control of Generation of Code ('Code Injection') ↗
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-116: Improper Encoding or Escaping of Output ↗
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-913: Improper Control of Dynamically-Managed Code Resources ↗
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Fonte: MITRE CWE
The EPSS (Exploit Prediction Scoring System) is a score from 0 to 1 that indicates the probability that a vulnerability will be exploited in the real world in the next 30 days. A higher value indicates a greater likelihood of exploitation.
The Percentile indicates how much higher this vulnerability's EPSS score is compared to all other vulnerabilities in the EPSS database. For example, a percentile of 0.90 (90%) means that 90% of vulnerabilities have an EPSS score equal to or lower than the current one.
*Data updated as of: 2026-09-18
The CISA KEV Catalog lists vulnerabilities that have been actively exploited in the real world. If a CVE is present in this catalog, it indicates that the threat is immediate and mitigation should be a top priority.
CVE CVE-2026-90999 is not present in the CISA KEV Catalog. This indicates that it is not currently classified by CISA as an actively exploited vulnerability.
No articles present on Red Hot Cyber.
Connection error to GitHub, or rate limit exceeded. Please try again later.