GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by Functional Software, Inc.

    CVE-2026-90999 (GCVE-0-2026-90999)

    Vulnerability from nvd – Published: 2026-09-16 15:45 – Updated: 2026-09-16 16:08
    VLAI
    Title
    Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment
    Summary
    Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim’s Sentry account, source repository, or infrastructure.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-16T16:08:56.590Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/212479"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Sentry Seer",
          "vendor": "Functional Software, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Web site"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim\u2019s Sentry account, source repository, or infrastructure."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-20 Improper Input Validation",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-116 Improper Encoding or Escaping of Output",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T15:45:47.463Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/212479"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment",
      "x_generator": {
        "engine": "VINCE 3.0.48",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-90999"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-90999",
    "datePublished": "2026-09-16T15:45:47.463Z",
    "dateReserved": "2026-09-14T15:22:28.291Z",
    "dateUpdated": "2026-09-16T16:08:56.590Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-90999 (GCVE-0-2026-90999)

    Vulnerability from cvelistv5 – Published: 2026-09-16 15:45 – Updated: 2026-09-16 16:08
    VLAI
    Title
    Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment
    Summary
    Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim’s Sentry account, source repository, or infrastructure.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-16T16:08:56.590Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/212479"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Sentry Seer",
          "vendor": "Functional Software, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Web site"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim\u2019s Sentry account, source repository, or infrastructure."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-20 Improper Input Validation",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-116 Improper Encoding or Escaping of Output",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T15:45:47.463Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/212479"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment",
      "x_generator": {
        "engine": "VINCE 3.0.48",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-90999"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-90999",
    "datePublished": "2026-09-16T15:45:47.463Z",
    "dateReserved": "2026-09-14T15:22:28.291Z",
    "dateUpdated": "2026-09-16T16:08:56.590Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}