CVE-2026-83527

HighCVSS 8.1/10Last modified Sep 9, 2026

Description

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 8, 2026
Last modified
Sep 9, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-83534.8Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScrCVE-2026-835304.3A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, andCVE-2026-835318.8Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language StatemCVE-2026-835326.8The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering themCVE-2026-835335.3The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an orCVE-2026-835346.4PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arCVE-2026-835357.4A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer SCVE-2026-835365.3A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such CVE-2026-835375.3The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an orCVE-2026-83546.4The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions upCVE-2026-835408.8When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticatedCVE-2026-835416.8The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within
CVE-2026-83527: High severity, CVSS 8.1 | Vulnix