CVE-2026-25805

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even malicious values could be used without the user having a chance to notice it. Patched in Zed Editor 0.219.4 which includes expandable tool call details.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-356

Affected software

No affected versions have been published.

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-258066.5PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/stud CVE-2026-258078.8ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal shar CVE-2026-258087.5Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a CVE-2026-258099.8PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not vali CVE-2026-25815.9This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici version CVE-2026-258109.1PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.CVE-2026-258119.1PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identif CVE-2026-258128.8PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enables credentialed CORS CVE-2026-258137.5PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data CVE-2026-258149.8PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passe CVE-2026-258153.2Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild f CVE-2026-258178.8HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 ha