CVE-2026-5376

MediumCVSS 5.9/10Last modified Oct 26, 2026

Description

An issue that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolved. This is an instance of CWE-613: Insufficient Control of Resources After Expiration or Release, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N (5.9 Medium). This issue was fixed in version 4.0.260203.0 of the runZero Platform.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
runZero	Platform	< 4.0.260203.0

References

https://help.runzero.com/docs/release-notes/#402602030Release Notes
https://www.runzero.com/advisories/runzero-platform-session-timeout-failure-cve-2026-5376/Vendor Advisory

Timeline

Published: Apr 7, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-537605.2Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installati CVE-2026-537618.2Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability CVE-2026-537626.2VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 an CVE-2026-537633.8OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the CVE-2026-537656.1Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.20.0 until 1.1.0, CVE-2026-537666.1Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.24.0 until 1.1.0, CVE-2026-537696.5Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment uplo CVE-2026-53774.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that could have allowed an authenticated use CVE-2026-537769.1Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unco CVE-2026-537778.1Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any locatio CVE-2026-537797.5WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside CVE-2026-53786.8An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved. This is an