<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0">
  <channel>
    <title>runZero Query Library</title>
    <link>https://help.runzero.com/docs/em-queries/</link>
    <description>Latest queries published in the runZero Query Library</description>
    <language>en-us</language>
    <lastBuildDate>Mon, 18 May 2026 17:39:02 +0000</lastBuildDate>
    <item>
      <title>[Rapid Response] Rapid Response: Vercel Next.js SSRF Via WebSocket Upgrades (CVE-2026-44578)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Next.js, an open-source React framework developed by Vercel, provides structure, routing, and rendering solutions for&#xA;building full-stack web applications.&#xA;&#xA;Self-hosted Next.js applications using the built-in Node.js server are vulnerable to server-side request forgery&#xA;(SSRF) within the WebSocket upgrade handling mechanism. A remote, unauthenticated attacker can exploit this flaw by&#xA;sending crafted WebSocket upgrade requests. Successful exploitation allows the server to proxy requests to arbitrary&#xA;internal or external destinations. This can expose sensitive internal services or cloud infrastructure endpoints, such&#xA;as the Instance Metadata Service (IMDS), a local HTTP endpoint used by virtual machines to retrieve configurations,&#xA;IP addresses, and IAM roles via a link-local address.&#xA;&#xA;The following versions are affected:&#xA;- Next.js 13, 14, and 15: Versions 13.4.13 through 15.5.15&#xA;- Next.js 16: Versions 16.0.0 through 16.2.4&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;vendor:=Vercel AND product:=&amp;#34;Next.js&amp;#34;&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: software · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Mon, 18 May 2026 17:39:02 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#0ec18cb0-43da-406d-a1b6-92f35514664b</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: Cisco Catalyst SD-WAN Manager/Controller (CVE-2026-20182)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;The Cisco Catalyst SD-WAN Controller serves as the centralized control-plane element, utilizing the Overlay Management &#xA;Protocol (OMP) to manage routing intelligence, distribute security keys, and enforce network-wide policies. In &#xA;contrast, the Cisco Catalyst SD-WAN Manager acts as the centralized management system, providing the graphical &#xA;interface necessary for the configuration, monitoring, and orchestration of all devices within the fabric.&#xA;&#xA;A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco &#xA;Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass &#xA;authentication and obtain administrative privileges on an affected system. This vulnerability exists because the&#xA;peering authentication mechanism in an affected system is not working properly. An attacker could exploit this &#xA;vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to &#xA;log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using &#xA;this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network &#xA;configuration for the SD-WAN fabric.&#xA;&#xA;Note that there is evidence that this vulnerability is being *exploited in the wild*.&#xA;&#xA;The following versions are affected:&#xA;- Catalyst SD-WAN releases prior to 20.9&#xA;- Catalyst SD-WAN release 20.9 versions prior to 20.9.9.1&#xA;- Catalyst SD-WAN release 20.10 versions prior to 20.12.7.1&#xA;- Catalyst SD-WAN release 20.11 versions prior to 20.12.7.1&#xA;- Catalyst SD-WAN release 20.12 versions prior to 20.12.5.4&#xA;- Catalyst SD-WAN release 20.12 versions prior to 20.12.6.2&#xA;- Catalyst SD-WAN release 20.13 versions prior to 20.12.7.1&#xA;- Catalyst SD-WAN release 20.13 versions prior to 20.15.5.2&#xA;- Catalyst SD-WAN release 20.14 versions prior to 20.15.5.2&#xA;- Catalyst SD-WAN release 20.15 versions prior to 20.15.4.4&#xA;- Catalyst SD-WAN release 20.15 versions prior to 20.15.5.2&#xA;- Catalyst SD-WAN release 20.16 versions prior to 20.18.2.2&#xA;- Catalyst SD-WAN release 20.18 versions prior to 20.18.2.2&#xA;- Catalyst SD-WAN release 26.1 versions prior to 26.1.1.1&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;hw:=&amp;#34;Cisco vManage&amp;#34; OR os:=&amp;#34;Cisco Viptela OS&amp;#34;&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Thu, 14 May 2026 20:29:12 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#201c31f3-d676-4035-a9cb-340382df50f0</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: F5 NGINX (CVE-2026-42945)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Nginx is a high-performance, open-source software used primarily as a web server and reverse proxy to efficiently &#xA;handle large volumes of simultaneous connections. It is widely favored for its speed and stability, often serving &#xA;as a load balancer or HTTP cache to optimize the delivery of web content.&#xA;&#xA;A heap-based buffer overflow vulnerability exists in the `ngx_http_rewrite_module` component of NGINX Plus and NGINX &#xA;Open Source base products. The flaw is triggered when a `rewrite` directive is followed by a `rewrite`, `if`, or `set`&#xA;directive that uses an unnamed PCRE capture group (e.g., `$1`, `$2`) whose replacement string contains a question mark&#xA;(?). An unauthenticated, remote attacker may exploit this by sending specially crafted HTTP requests, causing a heap &#xA;buffer overflow in the NGINX worker process and resulting in a service restart. On systems where Address Space Layout &#xA;Randomization (ASLR) is disabled, exploitation may also allow arbitrary code execution.&#xA;&#xA;The following product versions are affected:&#xA;- NGINX Plus: Versions R32 through R36&#xA;- NGINX Open Source: Versions 1.0.0 through 1.30.0&#xA;- NGINX Open Source: Versions 0.6.27 through 0.9.7&#xA;- NGINX Instance Manager: Versions 2.16.0 through 2.21.1&#xA;- F5 WAF for NGINX: Versions 5.9.0 through 5.12.1&#xA;- NGINX App Protect WAF: Versions 5.1.0 through 5.8.0&#xA;- NGINX App Protect WAF: Versions 4.9.0 through 4.16.0&#xA;- F5 DoS for NGINX: Version 4.8.0&#xA;- NGINX App Protect DoS: Versions 4.3.0 through 4.7.0&#xA;- NGINX Gateway Fabric: Versions 2.0.0 through 2.5.1&#xA;- NGINX Gateway Fabric: Versions 1.3.0 through 1.6.2&#xA;- NGINX Ingress Controller: Versions 5.0.0 through 5.4.1&#xA;- NGINX Ingress Controller: Versions 4.0.0 through 4.0.1&#xA;- NGINX Ingress Controller: Versions 3.5.0 through 3.7.2&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;((vendor:=&amp;#34;F5&amp;#34; OR vendor:=&amp;#34;NGINX&amp;#34;) AND  (product:=&amp;#34;nginx plus&amp;#34; OR product:=&amp;#34;nginx&amp;#34; OR product:=&amp;#34;nginx ingress controller&amp;#34;))&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: software · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Wed, 13 May 2026 21:39:19 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#bed46c5e-8df9-45b7-9169-0b2995af1167</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: Palo Alto Networks PAN-OS RCE In IKEv2 Processing (CVE-2026-0263)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;PAN-OS is the proprietary operating system that powers all Palo Alto Networks Next-Generation Firewalls (NGFW) &#xA;across physical, virtual, and cloud environments. It uses a Single-Pass Parallel Processing (SP3) architecture &#xA;to provide deep visibility and control over network traffic by identifying applications, users, and content &#xA;simultaneously.&#xA;&#xA;Several versions of Palo Alto Networks PAN-OS are vulnerable to a high buffer overflow during IKEv2 handling. A &#xA;remote, unauthenticated attacker can exploit this over the network to either gain elevated code execution or disrupt &#xA;services entirely.&#xA;&#xA;The following versions are affected&#xA;- PAN-OS versions 12.1.5 through 12.1.6, 12.1.2 through 12.1.4-h*.&#xA;- PAN-OS 11.2 versions 11.2.11 or later, 11.2.8 through 11.2.10-h*, 11.2.5 through 11.2.7-h*, or 11.2.0 through 11.2.4-h*.&#xA;- PAN-OS 11.1 versions 11.1.14 or later, 11.1.11 through 11.1.13-h*, 11.1.8 through 11.1.10-h*, 11.1.7 through 11.1.7-h*, 11.1.5 through 11.1.6-h*, 11.1.0 through 11.1.4-h*.&#xA;&#xA;Note: This vulnerability only affects PA-Series hardware.&#xA;&#xA;Severity &amp;amp; Risk Assessment&#xA;- Severity: High – Successful exploitation could allow an attacker to potentially execute arbitrary code on the vulnerable system.&#xA;- Risk: High – This vulnerability can be exploited by an unauthenticated remote attacker, meaning the barrier to entry&#xA;for an attacker is low. This significantly increases the likelihood of widespread exploitation.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;hw:=&amp;#34;Palo Alto Networks&amp;#34; AND os:=&amp;#34;Palo Alto Networks PAN-OS%&amp;#34; AND os_version:&amp;gt;0 AND ((os_version:&amp;gt;=&amp;#34;12.1.5&amp;#34; AND os_version:&amp;lt;&amp;#34;12.1.7&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;12.1.2&amp;#34; AND os_version:&amp;lt;&amp;#34;12.1.4-h5&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;11.2.11&amp;#34; AND os_version:&amp;lt;&amp;#34;11.2.12&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;11.2.8&amp;#34; AND os_version:&amp;lt;&amp;#34;11.2.10-h6&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;11.2.5&amp;#34; AND os_version:&amp;lt;&amp;#34;11.2.7-h13&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;11.2.0&amp;#34; AND os_version:&amp;lt;&amp;#34;11.2.4-h17&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;11.1.14&amp;#34; AND os_version:&amp;lt;&amp;#34;11.1.15&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;11.1.11&amp;#34; AND os_version:&amp;lt;&amp;#34;11.1.13-h5&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;11.1.8&amp;#34; AND os_version:&amp;lt;&amp;#34;11.1.10-h25&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;11.1.7&amp;#34; AND os_version:&amp;lt;&amp;#34;11.1.7-h6&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;11.1.5&amp;#34; AND os_version:&amp;lt;&amp;#34;11.1.6-h32&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;11.1.0&amp;#34; AND os_version:&amp;lt;&amp;#34;11.1.4-h33&amp;#34;))&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Rapid Response · Severity: High&lt;/p&gt;</description>
      <pubDate>Wed, 13 May 2026 18:07:31 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#761f1c58-49b0-45b4-9b32-210d3187c294</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: Exim Unauthenticated RCE (CVE-2026-45185)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Exim is an open-source Mail Transfer Agent (MTA) for Unix-like operating systems that manages the routing and delivery&#xA;of email messages via SMTP using a highly flexible and programmable configuration system.&#xA;&#xA;Certain versions of Exim are susceptible to a critical remote code execution (RCE) vulnerability caused by a&#xA;use-after-free condition in the BDAT body parsing path. The flaw is specifically triggered when Exim is configured to&#xA;use GnuTLS, the default TLS library for many Debian-based distributions. The vulnerability occurs when a client sends&#xA;a TLS `close_notify` alert mid-body during an SMTP CHUNKING (RFC 3030) transfer, followed by a final cleartext byte on&#xA;the same TCP connection. This specific sequence leads to heap corruption, which a remote, unauthenticated attacker can&#xA;leverage to execute arbitrary code on the system.&#xA;&#xA;The following versions are affected:&#xA;- Exim: Versions prior to 4.99.3 (when configured with GnuTLS).&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;product:=exim AND banner:&amp;#34;STARTTLS&amp;#34;&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: services · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Wed, 13 May 2026 13:50:58 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#a9cab9e5-1beb-4a84-9f08-a7692b6bb99e</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: Fortinet FortiAuthenticator RCE (CVE-2026-44277)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;FortiAuthenticator is a centralized Identity and Access Management (IAM) solution that provides secure, &#xA;identity-based access across a network by managing user authentication, multi-factor authentication (MFA), and &#xA;single sign-on (SSO). It acts as a gatekeeper that integrates with existing directories to ensure only authorized &#xA;users and devices can access critical resources across the Fortinet Security Fabric and third-party systems.&#xA;&#xA;A improper access control vulnerability in multiple versions of Fortinet FortiAuthenticator may allow a remote &#xA;attacker to execute unauthorized code or commands via crafted requests.&#xA;&#xA;The following versions are affected:&#xA;- FortiAuthenticator 8.0: 8.0.0, 8.0.2&#xA;- FortiAuthenticator 6.6: Versions 6.6.0 through 6.6.8&#xA;- FortiAuthenticator 6.5: Versions 6.5.0 through 6.5.6&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;hw:FortiAuthenticator&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Tue, 12 May 2026 20:42:40 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#3bea58ba-0783-43e0-ace5-6591812a91a9</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: Fortinet FortiSandbox RCE (CVE-2026-26083)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Fortinet FortiSandbox is a security appliance that identifies unknown threats by executing suspicious files in &#xA;isolated virtual environments to monitor their behavior and then automates a response by sharing that intelligence &#xA;across the network to block the detected threat.&#xA;&#xA;A missing authorization vulnerability in multiple Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS  &#xA;may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests.&#xA;&#xA;The following versions are affected:&#xA;- FortiSandbox 5.0: Versions 5.0.0 through 5.0.1&#xA;- FortiSandbox 4.4: Versions 4.4.0 through 4.4.8&#xA;- FortiSandbox Cloud 24: All versions&#xA;- FortiSandbox Cloud 23: All versions&#xA;- FortiSandbox Cloud 5.0: 5.0.2 through 5.0.5&#xA;- FortiSandbox PaaS 23.4: 23.4 all versions&#xA;- FortiSandbox PaaS 23.3: 23.3 all versions&#xA;- FortiSandbox PaaS 23.1: 23.1 all versions&#xA;- FortiSandbox PaaS 22.2: 22.2 all versions&#xA;- FortiSandbox PaaS 22.1: 22.1 all versions&#xA;- FortiSandbox PaaS 21.4: 21.4 all versions&#xA;- FortiSandbox PaaS 21.3: 21.3 all versions&#xA;- FortiSandbox PaaS 5.0: 5.0.0 through 5.0.1&#xA;- FortiSandbox PaaS 4.4: 4.4.5 through 4.4.8&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;os:=&amp;#34;Fortinet FortiSandbox%&amp;#34;&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Tue, 12 May 2026 19:07:37 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#9fa37834-7ec7-410b-81be-2f45b0a950a7</guid>
    </item>
    <item>
      <title>[End-of-Life] Xen Project XCP-ng</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;XCP-ng versions 7.4 through 7.6, as well as 8.0, 8.1, and 8.2 LTS, have all reached end-of-life (EOL) status.&#xA;Because EOL versions no longer receive security patches or functional updates, any existing or future vulnerabilities&#xA;will remain unresolved.&#xA;&#xA;Support End Dates:&#xA;- 8.2 LTS: September 16, 2025&#xA;- 8.1: March 31, 2021&#xA;- 8.0: November 13, 2020&#xA;- 7.6: March 30, 2020&#xA;- 7.5: July 25, 2019&#xA;- 7.4: October 31, 2018&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;os:=&amp;#34;Xen Project XCP-ng&amp;#34; AND (os_version:&amp;gt;0 AND os_version:&amp;lt;&amp;#34;8.3&amp;#34;)&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: End-of-Life · Severity: Info&lt;/p&gt;</description>
      <pubDate>Fri, 08 May 2026 04:34:13 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#3375ad69-c340-4293-a518-43e5f4fe1ba0</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: Ollama Heap Out-Of-Bounds Read (CVE-2026-7482)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Ollama is an open-source framework designed for the local deployment, management, and execution of large language&#xA;models (LLMs) on personal computing hardware.&#xA;&#xA;Certain versions of Ollama are susceptible to a heap out-of-bounds read vulnerability within the GGUF model loader.&#xA;A remote, unauthenticated attacker could exploit this by sending a specially crafted GGUF file to the `/api/create`&#xA;endpoint. When the server processes a GGUF file where the declared tensor offset and size exceed the file&amp;#39;s actual&#xA;length, the functions in `fs/ggml/gguf.go` and `server/quantization.go` (`WriteTo()`) read past the allocated heap&#xA;buffer during the quantization process.&#xA;&#xA;The resulting memory leak may expose sensitive information, including environment variables, API keys, system prompts,&#xA;and concurrent user conversation data. This data can then be exfiltrated by uploading the resulting model artifact to&#xA;an attacker-controlled registry via the `/api/push` endpoint. In the upstream distribution, the `/api/create` and&#xA;`/api/push` endpoints lack authentication. While default deployments bind to `127.0.0.1`, the documented&#xA;`OLLAMA_HOST=0.0.0.0` configuration is common in practice, leading to significant public Internet exposure.&#xA;&#xA;The following versions are affected:&#xA;- Ollama: Versions prior to 0.17.1&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;vendor:=Ollama AND product:=Ollama AND source:runzero&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: software · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Wed, 06 May 2026 17:28:11 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#213a3433-f3f4-45e5-bcab-17d417994414</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: Palo Alto Networks PAN-OS Remote Code Execution Vulnerability (CVE-2026-0300)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;PAN-OS is the proprietary operating system that powers all Palo Alto Networks Next-Generation Firewalls (NGFW) &#xA;across physical, virtual, and cloud environments. It uses a Single-Pass Parallel Processing (SP3) architecture &#xA;to provide deep visibility and control over network traffic by identifying applications, users, and content &#xA;simultaneously.&#xA;&#xA;Certain versions of PAN-OS across PA-Series and VM-series firewalls are susceptible to the following vulnerability:&#xA;&#xA;- CVE-2026-0300: A critical buffer overflow vulnerability in the User-ID Authentication Portal (Captive Portal)&#xA;of Palo Alto Networks PAN-OS that allows an unauthenticated remote attacker to execute arbitrary code with root &#xA;privileges.&#xA;&#xA;This vulnerability is known to be exploited in the wild, as determined by its presence on the CISA.gov &#xA;Known Exploited Vulnerabilities (KEV) list.&#xA;&#xA;The following versions are affected:&#xA;- PAN-OS versions 12.1 through 12.1.4-h5, and 12.1.7.&#xA;- PAN-OS 11.2 versions through 11.2.4-h17, 11.2.7-h13, 11.2.10-hh6, and 11.2.12.&#xA;- PAN-OS 11.1 versions through 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, and 11.1.15.&#xA;- PAN-OS 10.2 versions through 10.2.7-h34, 10.2.10-h36, 10.2.16-h21, 10.2.16-h7, and 10.2.18-h6.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;hw:=&amp;#34;Palo Alto Networks%&amp;#34; AND os:=&amp;#34;Palo Alto Networks PAN-OS%&amp;#34; AND  (tcp_port:6080 OR tcp_port:6081 OR tcp_port:6082)&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Wed, 06 May 2026 13:42:48 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#91173087-2493-427c-adf6-4fc86b630fe4</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: Progress MOVEit Automation Multiple Vulnerabilities (2026-04)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Progress MOVEit Automation is a managed file transfer (MFT) orchestration tool used to automate the scheduled or&#xA;event-driven movement and processing of data between disparate servers, cloud storage environments, and applications&#xA;via a centralized management interface.&#xA;&#xA;Certain versions of MOVEit Automation are susceptible to vulnerabilities within the service backend command port&#xA;interfaces. Successful exploitation could allow an attacker to gain unauthorized access, obtain administrative&#xA;control, or expose sensitive data.&#xA;&#xA;- CVE-2026-4670: An authentication bypass vulnerability that allows a remote, unauthenticated attacker to gain&#xA;unauthorized access to the system.&#xA;&#xA;- CVE-2026-5174: An improper input validation vulnerability that allows a remote, low-privileged attacker to elevate&#xA;their privileges.&#xA;&#xA;The following versions are affected:&#xA;- MOVEit Automation: Version 2024.1.7 (16.1.7) and prior&#xA;- MOVEit Automation: Version 2025.0.8 (17.0.8) and prior&#xA;- MOVEit Automation: Version 2025.1.4 (17.1.4) and prior (Affected by CVE-2026-5174 only)&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;_asset.protocol:http AND protocol:http AND (html.title:=&amp;#34;MOVEit Automation%&amp;#34; OR last.html.title:=&amp;#34;MOVEit Automation%&amp;#34;)&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: services · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Tue, 05 May 2026 04:54:14 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#d825a4fe-f7bb-4f72-9101-9d94ac6dfb3b</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: Apache HTTP Server HTTP2 Double Free And Possible RCE (CVE-2026-23918)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Apache HTTP Server is an open-source, cross-platform application that serves web content by processing requests via&#xA;the Hypertext Transfer Protocol (HTTP).&#xA;&#xA;Certain versions of Apache HTTP Server are affected by a double free vulnerability that may lead to remote code&#xA;execution (RCE). This flaw occurs within the HTTP/2 protocol implementation when a stream undergoes an &amp;#34;early reset.&amp;#34;&#xA;While further technical details are not publicly available at this time, the vulnerability involves a memory&#xA;management error triggered during specific HTTP/2 communication sequences.&#xA;&#xA;The following versions are affected:&#xA;- Apache HTTP Server: Version 2.4.66&#xA;&#xA;Severity &amp;amp; Risk Assessment&#xA;- Severity: High – Successful exploitation could allow an attacker to potentially execute arbitrary code on the vulnerable system.&#xA;- Risk: High – This vulnerability can be exploited by a low-privileged remote attacker, meaning the barrier to entry&#xA;for an attacker is low. This significantly increases the likelihood of widespread exploitation.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;vendor:=Apache AND product:=HTTPD AND version:&amp;gt;0 AND version:=2.4.66&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: software · Category: Rapid Response · Severity: High&lt;/p&gt;</description>
      <pubDate>Mon, 04 May 2026 18:11:26 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#7d2ede5a-090c-494b-a872-0ebb333dacd0</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: SonicWall SonicOS Multiple Vulnerabilities (2026-04)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;SonicWall SonicOS is the proprietary operating system that manages the networking, routing, and deep packet inspection&#xA;security functions for SonicWall physical and virtual firewall appliances.&#xA;&#xA;Certain versions of SonicOS across Gen 6, Gen 7, and Gen 8 firewall platforms are susceptible to the following&#xA;vulnerabilities:&#xA;&#xA;- CVE-2026-0204: A flaw in the access control mechanism may expose management interface functions under specific&#xA;conditions. An unauthenticated attacker with adjacent network access could gain unauthorized access to management&#xA;functionality, potentially leading to security control bypasses or administrative misuse.&#xA;&#xA;- CVE-2026-0205: A post-authentication path traversal vulnerability allows an authenticated attacker with adjacent&#xA;network access to interact with restricted services.&#xA;&#xA;- CVE-2026-0206: A post-authentication stack-based buffer overflow allows a remote, high-privileged attacker to cause&#xA;a denial-of-service (DoS) by crashing the firewall.&#xA;&#xA;While unconfirmed, the initial authentication bypass (CVE-2026-0204) may provide an unauthenticated attacker with the&#xA;privileges necessary to chain and exploit the subsequent path traversal and buffer overflow vulnerabilities.&#xA;&#xA;The following versions are affected:&#xA;- Gen 6 Series (TZ 300/400/500/600, NSA 2650–6650, SOHO 250, SM 9200–9650): SonicOS version 6.5.5.1-6n and prior.&#xA;- Gen 7 Series (TZ 270–670, NSa 2700–6700, NSsp 10700–15700, NSv 270-870): SonicOS 7.0.1-5169 and prior,&#xA;and 7.3.1-7013 and prior.&#xA;- Gen 8 Series (TZ 80–680, NSa 2800–5800): SonicOS version 8.1.0-8017 and prior.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;hw:=&amp;#34;SonicWall%&amp;#34; AND os:=&amp;#34;SonicWall SonicOS%&amp;#34; AND os_version:&amp;gt;0 AND ((os_version:&amp;lt;&amp;#34;6.5.5.2-28n&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;7&amp;#34; AND os_version:&amp;lt;&amp;#34;7.3.2-7010&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;8&amp;#34; AND os_version:&amp;lt;&amp;#34;8.2.0-8009&amp;#34;))&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Fri, 01 May 2026 17:48:08 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#7b7626f9-8217-4dd4-bb0b-cbe698272630</guid>
    </item>
    <item>
      <title>[Vulnerability] SonicWall SonicOS Multiple Vulnerabilities (2026-04)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;SonicWall SonicOS is the proprietary operating system that manages the networking, routing, and deep packet inspection&#xA;security functions for SonicWall physical and virtual firewall appliances.&#xA;&#xA;Certain versions of SonicOS across Gen 6, Gen 7, and Gen 8 firewall platforms are susceptible to the following&#xA;vulnerabilities:&#xA;&#xA;- CVE-2026-0204: A flaw in the access control mechanism may expose management interface functions under specific&#xA;conditions. An unauthenticated attacker with adjacent network access could gain unauthorized access to management&#xA;functionality, potentially leading to security control bypasses or administrative misuse.&#xA;&#xA;- CVE-2026-0205: A post-authentication path traversal vulnerability allows an authenticated attacker with adjacent&#xA;network access to interact with restricted services.&#xA;&#xA;- CVE-2026-0206: A post-authentication stack-based buffer overflow allows a remote, high-privileged attacker to cause&#xA;a denial-of-service (DoS) by crashing the firewall.&#xA;&#xA;While unconfirmed, the initial authentication bypass (CVE-2026-0204) may provide an unauthenticated attacker with the&#xA;privileges necessary to chain and exploit the subsequent path traversal and buffer overflow vulnerabilities.&#xA;&#xA;The following versions are affected:&#xA;- Gen 6 Series (TZ 300/400/500/600, NSA 2650–6650, SOHO 250, SM 9200–9650): SonicOS version 6.5.5.1-6n and prior.&#xA;- Gen 7 Series (TZ 270–670, NSa 2700–6700, NSsp 10700–15700, NSv 270-870): SonicOS 7.0.1-5169 and prior,&#xA;and 7.3.1-7013 and prior.&#xA;- Gen 8 Series (TZ 80–680, NSa 2800–5800): SonicOS version 8.1.0-8017 and prior.&#xA;&#xA;Severity &amp;amp; Risk Assessment&#xA;- Severity: High – Successful exploitation would allow an attacker unauthorized access to the management functionality&#xA;of the vulnerable system.&#xA;- Risk: High – The primary vulnerability (CVE-2026-0204) can be exploited without authentication, significantly&#xA;increasing the likelihood of an attack.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;hw:=&amp;#34;SonicWall%&amp;#34; AND os:=&amp;#34;SonicWall SonicOS%&amp;#34; AND os_version:&amp;gt;0 AND ((os_version:&amp;lt;&amp;#34;6.5.5.2-28n&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;7.0&amp;#34; AND os_version:&amp;lt;&amp;#34;7.3.2-7010&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;8.0&amp;#34; AND os_version:&amp;lt;&amp;#34;8.2.0-8009&amp;#34;))&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Vulnerability · Severity: High&lt;/p&gt;</description>
      <pubDate>Fri, 01 May 2026 17:48:08 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#e6be5feb-6e00-4363-9cb9-190180debc55</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: XCP-ng Multiple Vulnerabilities (2026-04)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;XCP-ng (Xen Cloud Platform - next generation) is a bare-metal hypervisor based on the open-source Xen project that&#xA;enables multiple virtual machines to run concurrently on a single physical server.&#xA;&#xA;On April 24, 2026, researchers publicly disclosed an audit identifying 89 exploitable vulnerabilities. These issues&#xA;primarily involve missing input validation across all writable `Map(String,String)` fields within eight XAPI object&#xA;types. Consequently, an attacker with the `vm-admin` management role could theoretically &amp;#34;achieve full host filesystem&#xA;read/write [access]&amp;#34; and execute &amp;#34;cross-VM data exfiltration&amp;#34; or &amp;#34;pool-wide compromise.&amp;#34; The report claims these&#xA;actions are possible through &amp;#34;single API calls with no exploit code,&amp;#34; requiring neither a root shell nor triggering&#xA;security alerts. These vulnerabilities reportedly persisted since the inception of the XAPI codebase (circa 2006).&#xA;The researchers assigned a CVSS distribution of 5 critical, 28 high, 46 medium, and 10 low, stating that all versions&#xA;of Citrix XenServer / Hypervisor, XCP-ng, and XAPI-based distributions were affected.&#xA;&#xA;On April 28, 2026, the Xen Project (upstream) and XCP-ng (downstream) released advisories addressing these claims.&#xA;The Xen Project issued technical advisories XSA-483 through XSA-489 to address the core source code. Notably, XSA-489&#xA;serves as a direct rebuttal to the April 24 audit, concluding that only five of the 89 claims were actionable.&#xA;The remainder were identified as intended Role-Based Access Control (RBAC) functionality or, in several instances,&#xA;appeared to be &amp;#34;AI hallucinations&amp;#34; within the researcher&amp;#39;s report. Simultaneously, XCP-ng published a blog providing&#xA;specific security and maintenance updates focused on the practical impact on XCP-ng environments.&#xA;&#xA;Vulnerability Details:&#xA;- CVE-2026-23556 (VSA-2026-007, XSA-483): A flaw where oxenstored keeps quota-related use counts across domain&#xA;destruction. XCP-ng notes this could allow a privileged user in a guest domain to trigger a denial-of-service (DoS)&#xA;condition by preventing other domains from starting; the XCP-ng advisory classifies this impact as critical.&#xA;&#xA;- CVE-2026-23557 (XSA-484): A denial-of-service (DoS) vulnerability via the XS_RESET_WATCHES command in xenstored.&#xA;&#xA;- CVE-2026-31786 (XSA-485): A Linux kernel out-of-bounds read via a Xen-related sysfs file, potentially leaking&#xA;sensitive information.&#xA;&#xA;- CVE-2026-23558 (VSA-2026-008, XSA-486): A race condition in grant table v2 status page mapping. XCP-ng notes this&#xA;use-after-free (UAF) flaw could allow a privileged user in a HVM or PVH guest domain to escalate their privileges to&#xA;the hypervisor level; the XCP-ng advisory classifies this impact as critical.&#xA;&#xA;- CVE-2026-31787 (XSA-487): A Linux kernel double-free in the Xen privcmd driver; as it requires root privileges, the&#xA;Xen Project considers the crash potential not security-relevant.&#xA;&#xA;- CVE-2025-54505 (VSA-2026-010, XSA-488): Addresses &amp;#34;Floating Point Divider State Sampling&amp;#34; on certain AMD CPUs. While&#xA;not a XCP-ng software vulnerability, this update mitigates a hardware issue to prevent a guest VM from inferring data&#xA;from another VM; the XCP-ng advisory classifies this impact as moderate.&#xA;&#xA;- XAPI RBAC Escalation (VSA-2026-011, XSA-489): This advisory confirms five actionable vulnerabilities:&#xA;CVE-2026-23559, CVE-2026-23560, CVE-2026-23561, CVE-2026-23562, and CVE-2026-42486. While the first three may allow&#xA;`vm-admin` role users to escalate to `root` privileges in the control domain, the flaw relies on advanced RBAC&#xA;features not typically exposed in standard management tools or documentation; the XCP-ng advisory classifies this&#xA;impact as low. This would only impact users with a specific configuration involving an XCP-ng pool using Active&#xA;Directory for user management where the managed user has the XAPI role `vm-admin`.&#xA;&#xA;Note: Current advisories suggest that Xen Project vulnerabilities CVE-2026-23557, CVE-2026-31786, CVE-2026-31787,&#xA;CVE-2026-23562, and CVE-2026-42486 have not yet been addressed specifically by XCP-ng updates.&#xA;&#xA;The following versions are affected:&#xA;- XCP-ng: Version 8.3&#xA;&#xA;Note: XCP-ng 8.3 LTS is currently the only release not marked end-of-life (EOL). Therefore, older versions are likely&#xA;susceptible to these vulnerabilities but fall outside the scope of current security patching and support.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;_asset.protocol:http AND protocol:http AND (html.title:=&amp;#34;Welcome to XCP-ng%&amp;#34; OR html.title:=&amp;#34;XO Lite&amp;#34;)&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: services · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Thu, 30 Apr 2026 14:40:51 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#bedcfc0a-8941-4266-8f29-b301f1b954bc</guid>
    </item>
    <item>
      <title>[Best Practice] Interal Multi-Homed Routing Assets</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects assets that appear to have an internally-accessible&#xA;attack surface, have multiple IP addresses, and have IP forwarding enabled.&#xA;Such assets may be able to forward network traffic, potentially violating&#xA;network segmentation.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;address_count:&amp;gt;1 AND (has:ipv6.forwarding OR has:ipv4.forwarding) AND attack_surface:internal&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Best Practice · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#16ca8fad-7323-40d6-b700-d511b6e469c6</guid>
    </item>
    <item>
      <title>[Internet Exposure] New Public Assets</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects assets that appear to have an externally-accessible attack surface,&#xA;and that have been first detected within the last seven days.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;attack_surface:external AND first_seen:&amp;lt;7days&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Internet Exposure · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#2812a2bf-b7d4-4a11-9c9b-02dce4475f64</guid>
    </item>
    <item>
      <title>[Internet Exposure] Externally Exposed Database Services</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects services that have a public IP address, and that provide&#xA;services for databases or configuration repositories. Generally, such services&#xA;should not be exposed to public networks.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;service_has_public:t AND _asset.protocol:&amp;#34;{smb1,smb2,smb3,nfs,zookeeper,etcd2,consul,memcache,redis,mongodb,couchdb,cassandra,elasticsearch,riak,influxdb,mysql,mysqlx,postgresql,mssql,oracledb}&amp;#34; AND protocol:&amp;#34;{smb1,smb2,smb3,nfs,zookeeper,etcd2,consul,memcache,redis,mongodb,couchdb,cassandra,elasticsearch,riak,influxdb,mysql,mysqlx,postgresql,mssql,oracledb}&amp;#34;&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: services · Category: Internet Exposure · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#80883c2a-caeb-4272-9b03-6951d368e8cc</guid>
    </item>
    <item>
      <title>[End-of-Life] All End-Of-Life Assets</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects assets that have an operating system has has reached end-of-life.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;os_eol_expired:t&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: End-of-Life · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#4adb188a-a527-4ec1-96a2-d2c220adc126</guid>
    </item>
    <item>
      <title>[Best Practice] Externally Exposed and Risky OT and IT</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects OT and IoT assets that have a high or critical associated risk and&#xA;that appear to have an externally-accessible attack surface. OT and IoT systems should&#xA;in general not be exposed to public networks.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;(category:=OT OR category:=IoT) AND  (risk:high OR risk:critical OR attack_surface:external)&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Best Practice · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#2ebc64df-d87e-48d7-a2a9-020d8dd99d77</guid>
    </item>
    <item>
      <title>[Vulnerability] Exploitable External Assets</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects assets that appear to have an externally-accessible attack surface,&#xA;as well as a at least one detected vulnerability that is known to be exploitable.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;vuln_exploitable:t AND attack_surface:external&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Vulnerability · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#bf3b2871-613f-4a12-a722-28309a3b7aca</guid>
    </item>
    <item>
      <title>[End-of-Life] End-Of-Life External Assets</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects all assets that appear to have an externally-accessible attack surface,&#xA;and whose operating systems have reached end-of-life.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;os_eol_expired:t AND attack_surface:external&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: End-of-Life · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#6a31570f-3541-4ecd-a40d-3cd75a9ee91d</guid>
    </item>
    <item>
      <title>[Vulnerability] Exploitable Internal Assets</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects assets that appear to have an interally-accessible attack surface&#xA;and at least on vulnerability that is known to be exploitable.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;vuln_exploitable:t AND attack_surface:internal&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Vulnerability · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#d1445251-f22c-413a-95db-5903a0877943</guid>
    </item>
    <item>
      <title>[Best Practice] Multi-Homed Routing Assets</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects ll assets that are multi-homed and have traffic forwarding.&#xA;Such assets could potentially act as network bridges between network segments,&#xA;leading to potential segmentation issues.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;address_count:&amp;gt;1 AND  (has:ipv6.forwarding OR has:ipv4.forwarding)&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Best Practice · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#a32d2645-d24c-4415-8568-1dc305c92b88</guid>
    </item>
    <item>
      <title>[Internet Exposure] Externally Exposed Management Interfaces</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects assets that appear to have an externally-accessible attack surface,&#xA;and an exposed administrative interface.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;source:runZero AND foreign_id:=&amp;#34;rz-scan-vscan-%-panel&amp;#34; AND attack_surface:external&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: vulnerabilities · Category: Internet Exposure · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#d85222a1-7f76-408a-86f3-0a273b1d99e1</guid>
    </item>
    <item>
      <title>[Vulnerability] Exploitable Vulnerabilities</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects all vulnerabilities known to be exploitable.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;exploitable:t&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: vulnerabilities · Category: Vulnerability · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#59a2ad32-8c42-47f3-8b77-75a311e82a04</guid>
    </item>
    <item>
      <title>[Best Practice] Cloud Management Services</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects assets that appear to have a cloud-accessible attack surface,&#xA;as well as an exposed administrative interface.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;source:runZero AND foreign_id:=&amp;#34;rz-scan-vscan-%-panel&amp;#34; AND attack_surface:cloud&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: vulnerabilities · Category: Best Practice · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#3bf61671-ae28-4312-b7b3-15858a063161</guid>
    </item>
    <item>
      <title>[Vulnerability] Exploitable Cloud Assets</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects assets that appear to have a cloud-accessible attack&#xA;surface, and have at least one known-exploitable vulnerability present.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;vuln_exploitable:t AND attack_surface:cloud&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Vulnerability · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#5c0699de-251b-4a42-ae2c-809e48aee3d4</guid>
    </item>
    <item>
      <title>[End-of-Life] End-Of-Life Cloud Assets</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects assets that appear to have a cloud-accessible attack surface,&#xA;and whose operating systems have reached end-of-life.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;os_eol_expired:t AND attack_surface:cloud&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: End-of-Life · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#b5f52b37-f3d3-4a0e-bd3f-706657d994d4</guid>
    </item>
    <item>
      <title>[Vulnerability] Assets With Active RR Vulnerability</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects assets that are covered by an active Rapid Response.&#xA;Rapid Responses denote pontential or actual security issues that are&#xA;known to be under active exploitation.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;finding_code:rz-finding-rapid-response-assets OR finding_code:rz-finding-rapid-response-services&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Vulnerability · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#1a2c26af-218b-4620-be86-414cce69c0cc</guid>
    </item>
    <item>
      <title>[End-of-Life] End-Of-Life Internal Assets</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects assets that appear to have an internally-accessible attack surface,&#xA;and an operating system that has reached end-of-life.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;os_eol_expired:t AND attack_surface:internal&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: End-of-Life · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#bda589a0-4886-497a-b45e-77166dd4970c</guid>
    </item>
    <item>
      <title>[Internet Exposure] Public OT and IoT Assets</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;This query detects OT and IoT devices that appear to have an externally-accessible&#xA;attack surface. Generally, OT and IoT devices should not be exposed to public&#xA;networks.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;attack_surface:external AND (category:=OT OR category:=IoT)&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Internet Exposure · Severity: Low&lt;/p&gt;</description>
      <pubDate>Wed, 29 Apr 2026 11:49:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#e8cf2af0-18e7-4ede-8399-44e08cc5cdc3</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: cPanel &amp; WHM Login Authentication Vulnerability (2026-04)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;cPanel &amp;amp; WHM comprises two primary components: WebHost Manager (WHM), the administrative interface for server-level&#xA;infrastructure, and cPanel, the user-facing control panel for managing individual hosting accounts.&#xA;&#xA;Certain versions of cPanel &amp;amp; WHM are affected by a critical login authentication vulnerability. While public details&#xA;are currently limited, the changelogs for the affected versions cite a fix for an issue regarding session loading and&#xA;saving (CPANEL-52908), released on April 28, 2026. This vulnerability does not currently have a CVE ID assigned.&#xA;&#xA;Update (April 29, 2026): New details identify this flaw as an authentication bypass vulnerability, now tracked as&#xA;CVE-2026-41940. The weakness resides in the login flow, enabling remote, unauthenticated attackers to gain full&#xA;unauthorized access to the control panel.&#xA;&#xA;There is evidence that this vulnerability is being actively *exploited in the wild*.&#xA;&#xA;The following versions are affected:&#xA;- cPanel &amp;amp; WHM 110.0.x: Versions prior to 110.0.97 (11.110.0.97)&#xA;- cPanel &amp;amp; WHM 118.0.x: Versions prior to 118.0.63 (11.118.0.63)&#xA;- cPanel &amp;amp; WHM 126.0.x: Versions prior to 126.0.54 (11.126.0.54)&#xA;- cPanel &amp;amp; WHM 132.0.x: Versions prior to 132.0.29 (11.132.0.29)&#xA;- cPanel &amp;amp; WHM 134.0.x: Versions prior to 134.0.20 (11.134.0.20)&#xA;- cPanel &amp;amp; WHM 136.0.x: Versions prior to 136.0.5 (11.136.0.5)&#xA;&#xA;Note: Servers running end-of-life or unsupported versions are also likely affected. It is strongly recommended that&#xA;you upgrade your server to a supported, patched version immediately.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;vendor:=cPanel AND (product:=cPanel OR product:=WHM)&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: software · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Tue, 28 Apr 2026 22:30:54 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#132e331b-549c-4ddc-83aa-8f27dd7c35af</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: GitHub Enterprise Server RCE (CVE-2026-3854)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;GitHub Enterprise Server (GHES) is a self-hosted version of GitHub that allows organizations to run an isolated&#xA;instance of the platform on their own physical or virtual infrastructure, independent of external cloud services.&#xA;&#xA;Certain versions of GHES are affected by a remote code execution (RCE) vulnerability due to improper neutralization of&#xA;special elements. Successful exploitation could allow an authenticated, low-privileged user with push access to any&#xA;repository, including one they created themselves, to achieve arbitrary command execution on the GitHub server via a&#xA;single `git push` using crafted push option values containing an unsanitized delimiter character.&#xA;&#xA;The following versions are affected:&#xA;- GHES 3.14.x: Versions prior to 3.14.25&#xA;- GHES 3.15.x: Versions prior to 3.15.20&#xA;- GHES 3.16.x: Versions prior to 3.16.16&#xA;- GHES 3.17.x: Versions prior to 3.17.13&#xA;- GHES 3.18.x: Versions prior to 3.18.7&#xA;- GHES 3.19.x: Versions prior to 3.19.4&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;vendor:=GitHub AND product:=&amp;#34;Enterprise%&amp;#34;&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: software · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Tue, 28 Apr 2026 21:16:42 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#1be5e7f9-8e5b-4280-8531-af5eaae8501f</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: Citrix Hypervisor Multiple Vulnerabilities (2026-04)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Citrix XenServer, formerly known as Citrix Hypervisor, is a bare-metal hypervisor based on the open-source Xen project&#xA;that enables multiple virtual machines to run concurrently on a single physical server.&#xA;&#xA;On April 24, 2026, researchers publicly disclosed an audit identifying 89 exploitable vulnerabilities. These issues&#xA;primarily involve missing input validation across all writable `Map(String,String)` fields within eight XAPI object&#xA;types. Consequently, an attacker with the `vm-admin` management role &amp;#34;can achieve full host filesystem read/write&#xA;[access], cross-VM data exfiltration, storage protocol injection, cross-hypervisor lateral movement, and pool-wide&#xA;compromise through single API calls with no exploit code, no root shell, and no security alerts.&amp;#34; These&#xA;vulnerabilities have persisted since the inception of the XAPI codebase (circa 2006). The researchers assigned the&#xA;following CVSS severity distribution: 5 critical, 28 high, 46 medium, and 10 low.&#xA;&#xA;These vulnerabilities do not currently have CVE IDs assigned.&#xA;&#xA;The following products and versions are affected:&#xA;- Citrix Hypervisor or XenServer: All versions&#xA;- XCP-ng: All versions&#xA;- Any XAPI-based hypervisor distribution&#xA;&#xA;Update (April 29, 2026): The Xen Project (upstream) and Citrix (downstream) released separate but related advisories&#xA;to address these claims. The Xen Project issued technical advisories XSA-483 through XSA-489 to address the core&#xA;source code. Notably, XSA-489 serves as a direct rebuttal to the April 24 audit, concluding that only five of the 89&#xA;claims were actionable. The remainder were identified as intended RBAC functionality or, in several instances,&#xA;appeared to be &amp;#34;AI hallucinations&amp;#34; within the researcher&amp;#39;s report.&#xA;&#xA;Simultaneously, Citrix released Security Bulletin CTX696527 to provide specific updates and hotfixes for commercial&#xA;users, focusing on the practical impact to the XenServer environments.&#xA;&#xA;Vulnerability Details:&#xA;- CVE-2026-23556 (XSA-483): A flaw where oxenstored keeps quota-related use counts across domain destruction. Citrix&#xA;notes this could allow a privileged user in a guest VM to cause the host to crash or become unresponsive.&#xA;&#xA;- CVE-2026-23557 (XSA-484): A Denial of Service (DoS) vulnerability via the XS_RESET_WATCHES command in xenstored.&#xA;&#xA;- CVE-2026-31786 (XSA-485): A Linux kernel out-of-bounds read via a Xen-related sysfs file, potentially leaking&#xA;sensitive information.&#xA;&#xA;- CVE-2026-23558 (XSA-486): A race condition in grant table v2 status page mapping. Citrix notes this could allow a&#xA;privileged user in a guest VM to compromise the host under specific circumstances.&#xA;&#xA;- CVE-2026-31787 (XSA-487): A Linux kernel double-free in the Xen privcmd driver; as it requires root privileges, the&#xA;Xen Project considers the crash potential not security-relevant.&#xA;&#xA;- CVE-2025-54505 (XSA-488): Addresses &amp;#34;Floating Point Divider State Sampling&amp;#34; on certain AMD CPUs. While not a&#xA;XenServer software vulnerability, this update mitigates a hardware issue to prevent a guest VM from inferring data&#xA;from a different VM.&#xA;&#xA;- XAPI RBAC Escalation (XSA-489): This advisory confirms five actionable vulnerabilities: CVE-2026-23559,&#xA;CVE-2026-23560, CVE-2026-23561, CVE-2026-23562, and CVE-2026-42486. Citrix warns that the first three in particular&#xA;may allow host administrators to gain access beyond the limits of their assigned RBAC role.&#xA;&#xA;Note: Current advisories suggest that Xen Project vulnerabilities CVE-2026-23557, CVE-2026-31786, CVE-2026-31787,&#xA;CVE-2026-23562, and CVE-2026-42486 have not yet been addressed specifically by Citrix updates.&#xA;&#xA;The following versions are affected:&#xA;- Citrix XenServer: Version 8.4&#xA;&#xA;Note: Citrix XenServer 9.x is currently in Public Preview and not covered by standard security bulletins; as such, it&#xA;may be affected by these issues.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;os:=&amp;#34;Citrix XenServer&amp;#34;&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Mon, 27 Apr 2026 18:43:24 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#0869e812-e158-466d-9a62-6849047ece96</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: LiteLLM Proxy Multiple Vulnerabilities (2026-04)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;LiteLLM Proxy is an open-source gateway that enables applications to interact with multiple large language model&#xA;(LLM) providers through a single, standardized API by translating requests into the specific formats required by&#xA;each service.&#xA;&#xA;Certain versions of LiteLLM Proxy are susceptible to multiple vulnerabilities that can be chained together to achieve&#xA;remote code execution (RCE). In the official LiteLLM container images, the process runs as `root`. For deployments&#xA;outside of these official containers, the code executes with the privileges of the user account running the proxy&#xA;process. Research regarding the exploit chain involving GHSA-r75f-5x8p-qvmc and GHSA-xqmj-j6mv-4862 indicates that the&#xA;vulnerable code path only triggers after the server has processed &amp;#34;a minimum amount of legitimate interaction.&amp;#34;&#xA;&#xA;These vulnerabilities do not currently have CVE IDs assigned.&#xA;Update (April 27, 2026): The advisories now reflect assigned CVE IDs; however, these remain in a &amp;#34;reserved&amp;#34; state, and&#xA;further details have not yet been provided by the CNA.&#xA;&#xA;Update (May 8, 2026): There is evidence that CVE-2026-42208 is being actively *exploited in the wild*.&#xA;&#xA;- CVE-2026-42208: A SQL injection vulnerability exists in the API key verification process due to improper error&#xA;handling. A remote, unauthenticated attacker can exploit this by sending a specially crafted `Authorization` header to&#xA;any LLM API endpoint (e.g., `/chat/completions`). Successful exploitation allows an attacker to read or potentially&#xA;modify database data, leading to unauthorized access to the proxy and the credentials it manages.&#xA;&#xA;- CVE-2026-42203: A server-side template injection (SSTI) vulnerability in the `/prompts/test` API endpoint&#xA;arises from the improper neutralization of user-supplied prompt templates, which are rendered without sandboxing.&#xA;A crafted template can execute arbitrary code within the LiteLLM Proxy process. Successful exploitation allows a&#xA;remote, authenticated user to access secrets in the process environment (e.g., provider API keys or database&#xA;credentials) or execute arbitrary code on the host.&#xA;&#xA;- CVE-2026-42271: An authenticated command execution vulnerability exists in the MCP stdio test endpoints&#xA;(`/mcp-rest/test/connection` and `/mcp-rest/test/tools/list`), which are used to preview an MCP server before saving.&#xA;A remote, low-privileged attacker can exploit this by providing a crafted server configuration in the request body.&#xA;The command is spawned as a subprocess on the proxy host with the privileges of the proxy process.&#xA;&#xA;The following versions are affected:&#xA;- LiteLLM: Versions 1.81.16 through 1.83.6&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;_asset.protocol:http AND protocol:http AND (html.title:=&amp;#34;LiteLLM%&amp;#34; OR last.html.title:=&amp;#34;LiteLLM%&amp;#34;)&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: services · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Thu, 23 Apr 2026 21:00:10 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#37649df4-4433-4118-843a-855dcf6c4e16</guid>
    </item>
    <item>
      <title>[Rapid Response] Rapid Response: CrowdStrike Falcon LogScale Unauthenticated Path Traversal (CVE-2026-40050)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;CrowdStrike Falcon LogScale (formerly Humio) is a log management and observability platform that ingests, stores, and&#xA;enables real-time search of large-volume streaming data using an index-free architecture.&#xA;&#xA;Certain versions of self-hosted LogScale are susceptible to an unauthenticated path traversal vulnerability. A remote,&#xA;unauthenticated attacker could exploit a specific, exposed cluster API endpoint to read arbitrary files from the&#xA;server filesystem. This vulnerability does not affect Next-Gen SIEM customers.&#xA;&#xA;The following versions are affected:&#xA;- LogScale Self-Hosted (GA): Versions 1.224.0 through 1.234.0 (inclusive)&#xA;- LogScale Self-Hosted (LTS): Version 1.228.0 and 1.228.1&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;_asset.protocol:http AND protocol:http AND (http.head.server:=&amp;#34;Humio-%&amp;#34; OR last.http.head.server:=&amp;#34;Humio-%&amp;#34;)&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: services · Category: Rapid Response · Severity: Info&lt;/p&gt;</description>
      <pubDate>Wed, 22 Apr 2026 18:03:03 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#82de4a4a-fd34-463a-a3d7-d6a17a873af3</guid>
    </item>
    <item>
      <title>[Vulnerability] Apple Device Ecosystem Multiple Vulnerabilities (Coruna)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Several vulnerabilities affecting Apple&amp;#39;s device ecosystem have been weaponized&#xA;into an exploit chain known as Coruna. These vulnerabilities enable remote code&#xA;execution and payload deployment when a user visits a malicious website.&#xA;&#xA;The exploit chain is known to include at least 23 vulnerabilities targeting iOS&#xA;13.0 up to version 17.2.1.&#xA;&#xA;This exploit chain is known to have been used by at least one commercial surveillance&#xA;vendor and suspected state-sponsored actors. In 2025, it was observed being used&#xA;by financially motivated threat actors from China. In March 2026, the chain and&#xA;related exploit kit tooling was leaked publicly and is now available for use&#xA;by a wider range of malicious actors.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;(os:=&amp;#34;apple ios&amp;#34; OR os:=&amp;#34;apple ipados&amp;#34; ) AND ((osversion:&amp;gt;=&amp;#34;17.0&amp;#34; AND osversion:&amp;lt;&amp;#34;17.5&amp;#34;) OR (osversion:&amp;gt;=&amp;#34;16.0&amp;#34; AND osversion:&amp;lt;&amp;#34;16.7.8&amp;#34;) OR (osversion:&amp;gt;=&amp;#34;15.0&amp;#34; AND osversion:&amp;lt;&amp;#34;15.7.8&amp;#34;) OR (osversion:&amp;gt;=&amp;#34;13.0&amp;#34; AND osversion:&amp;lt;&amp;#34;14.7&amp;#34;))&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Vulnerability · Severity: High&lt;/p&gt;</description>
      <pubDate>Mon, 30 Mar 2026 19:21:03 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#60aa635b-4bfc-4f51-8649-d978509a1922</guid>
    </item>
    <item>
      <title>[Vulnerability] Microsoft SharePoint Remote Code Execution Vulnerability (CVE-2026-20963)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Microsoft SharePoint is a web-based collaboration and document management platform&#xA;within the Microsoft 365 suite. It acts as a secure, centralized hub for storing,&#xA;organizing, sharing, and accessing information from any device.&#xA;&#xA;On January 13, 2026, Microsoft disclosed a remote code execution vulnerability,&#xA;designated CVE-2026-20963, in Microsoft SharePoint. The vulnerability is due to&#xA;deserialization of untrusted data in Microsoft SharePoint which allows a&#xA;remote, unauthenticated attacker to execute code over a network.&#xA;&#xA;While initially released with a CVSS score of 8.8, the score was updated to 9.8&#xA;on March 17, 2026.&#xA;&#xA;This vulnerability is known to be exploited in the wild and was added to the&#xA;CISA.gov Known Exploited Vulnerabilities (KEV) list on March 18, 2026.&#xA;&#xA;The following versions are affected:&#xA;- SharePoint Enterprise Server 2016 before version 16.0.5535.1001&#xA;- SharePoint Server 2019 before version 16.0.10417.20083&#xA;- SharePoint Server Subscription Edition before version 16.0.19127.20442&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;vendor:=Microsoft AND ( (product:=&amp;#34;SharePoint Server 2016&amp;#34; AND (version:&amp;gt;=16.0.4107.1002 AND version:&amp;lt;16.0.5535.1001)) OR (product:=&amp;#34;SharePoint Server 2019&amp;#34; AND (version:&amp;gt;=16.0.10711.37301 AND version:&amp;lt;16.0.10417.20083)) OR (product:=&amp;#34;SharePoint Server Subscription Edition&amp;#34; AND (version:&amp;gt;=16.0.0.1 AND version:&amp;lt;16.0.19127.20442)) )&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: software · Category: Vulnerability · Severity: Critical&lt;/p&gt;</description>
      <pubDate>Thu, 26 Mar 2026 13:59:51 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#a7aab51f-8841-4e45-8489-cb6b947d47bd</guid>
    </item>
    <item>
      <title>[Vulnerability] Apple Device Ecosystem Multiple Vulnerabilities (DarkSword)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Several vulnerabilities affecting Apple&amp;#39;s device ecosystem have been weaponized&#xA;into an exploit chain known as DarkSword. These vulnerabilities enable remote code&#xA;execution and payload deployment when a user visits a malicious website. &#xA;&#xA;This exploit chain is known to have been used by multiple commercial surveillance&#xA;vendors and suspected state-sponsored actors. In March 2026, the chain and&#xA;related exploit kit tooling was leaked publicly and is now available for use&#xA;by a wider range of malicious actors.&#xA;&#xA;There are 6 vulnerabilities known to be part of the DarkSword exploit chain:&#xA;&#xA;- CVE-2025-14174 - Memory corruption vulnerability in ANGLE, patched in 18.7.3 and 26.2&#xA;- CVE-2025-31277 - Memory corruption vulnerability in JavaScriptCore, patched in 18.6&#xA;- CVE-2025-43510 - Memory management vulnerability in the iOS kernel, patched in 18.7.2 and 26.1&#xA;- CVE-2025-43520 - Memory corruption vulnerability in the iOS kernel, patched in 18.7.2 and 26.1&#xA;- CVE-2025-43529 - Memory corruption vulnerability in JavaScriptCore, patched in 18.7.3 and 26.2&#xA;- CVE-2026-20700 - User-mode Pointer Authentication Code (PAC) bypass in dyld, patched in 26.3 &lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;(os:=&amp;#34;apple ios&amp;#34; OR os:=&amp;#34;apple ipados&amp;#34; OR os:=&amp;#34;apple tvos&amp;#34; OR os:=&amp;#34;apple macos&amp;#34; OR os:=&amp;#34;apple watchos&amp;#34; OR os:=&amp;#34;apple visionos&amp;#34;) AND osversion:&amp;gt;0 AND ( (osversion:&amp;gt;=&amp;#34;26.0&amp;#34; AND osversion:&amp;lt;&amp;#34;26.3&amp;#34;) OR (osversion:&amp;gt;=&amp;#34;18.0&amp;#34; AND osversion:&amp;lt;&amp;#34;18.7.3&amp;#34;) )&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Vulnerability · Severity: High&lt;/p&gt;</description>
      <pubDate>Tue, 24 Mar 2026 14:29:37 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#d8487bdb-bcda-4142-9a70-a63644e6589c</guid>
    </item>
    <item>
      <title>[Vulnerability] Langflow RCE (CVE-2026-33017)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Langflow is a popular, open-source tool for building and deploying AI-powered agents and workflows. &#xA;&#xA;A vulnerability was found in the `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint that &#xA;allows building public flows without requiring authentication. When the optional data parameter &#xA;is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code &#xA;in node definitions) instead of the stored flow data from the database. This code is passed to &#xA;`exec()` with zero sandboxing, resulting in unauthenticated remote code execution. This is &#xA;distinct from CVE-2025-3248, which fixed `/api/v1/validate/code` by adding authentication. The &#xA;`build_public_tmp` endpoint was designed to be unauthenticated for public flows. However, it &#xA;blindly accepts attacker-supplied flow data containing arbitrary executable code. &#xA;&#xA;The following versions are affected&#xA;- Langflow versions prior to 1.8.2&#xA;&#xA;This has been given a severity of *Critical* because&#xA;- Exploitation of this vulnerability allows an adversary to remotely execute arbitrary code.&#xA;&#xA;This has been given a risk of *Critical* because&#xA;- Exploitation of this vulnerability does not require authentication.  &lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;vendor:=Langflow AND product:=Langflow AND (version:&amp;gt;0 AND version:&amp;lt;1.8.2)&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: software · Category: Vulnerability · Severity: Critical&lt;/p&gt;</description>
      <pubDate>Fri, 20 Mar 2026 16:26:57 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#57f9a057-9888-4bd5-a4f8-c7d9eb5e33c5</guid>
    </item>
    <item>
      <title>[Vulnerability] UniFi Network Application Multiple Vulnerabilities (2026-03)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;UniFi Network Application provides centralized management for scaling and optimizing network performance, security, &#xA;and device configuration across enterprise, SOHO, or home networks.&#xA;&#xA;- CVE-2026-22557: Allows a malicious actor with access to the network the ability to exploit a Path Traversal &#xA;vulnerability to access files on the underlying system that could be manipulated to access an underlying account.&#xA;&#xA;- CVE-2026-22558: Allows a malicious actor with authenticated access to the network, the ability to exploit a NoSQL &#xA;Injection vulnerability to escalate privileges.&#xA;&#xA;The following versions are affected&#xA;- UniFi Network Application versions 10.1.85 and earlier&#xA;- UniFi Network Application versions 10.2.93 and earlier&#xA;- UniFi Network Application versions 9.0.114 and earlier&#xA;&#xA;This has been given a severity of *Critical* because&#xA;- Successful exploitation enables an adversary to escalate privileges on the vulnerable system.&#xA;&#xA;This has been given a risk of *Critical* because&#xA;- Exploitation of this vulnerability does not require authentication.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;vendor:=Ubiquiti AND product:=&amp;#34;UniFi Network&amp;#34; AND version:&amp;gt;0 AND (version:&amp;lt;9.0.118 OR (version:&amp;gt;=10.1.0 AND version:&amp;lt;10.1.89) OR (version:&amp;gt;=10.2.0 AND version:&amp;lt;10.2.97))&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: software · Category: Vulnerability · Severity: Critical&lt;/p&gt;</description>
      <pubDate>Thu, 19 Mar 2026 15:42:34 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#40c60c0c-b6db-47fe-9615-51492904f86a</guid>
    </item>
    <item>
      <title>[Vulnerability] IPMI 1.5 Legacy Null Authentication</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;The Intelligent Platform Management Interface (IPMI) commonly exposes a legacy session protocol that predates&#xA;RAKP and Redfish. Some BMCs still accept IPMI 1.5 session activation without a password when the &amp;#34;none&amp;#34;&#xA;authentication type is enabled.&#xA;&#xA;This configuration allows an attacker with network access to activate an administrative IPMI session without&#xA;valid credentials. An attacker that can compromise a BMC can reflash malicious firmware, dump configured&#xA;secrets, and attack the managed host through functions such as virtual media and KVM redirection.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;_asset.protocols:ipmi AND ipmi.passAuth:none&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: services · Category: Vulnerability · Severity: Critical&lt;/p&gt;</description>
      <pubDate>Sun, 15 Mar 2026 22:28:43 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#c27d376b-ec66-44ed-aeaa-12625d30f3e2</guid>
    </item>
    <item>
      <title>[Vulnerability] Veeam Backup &amp; Replication Multiple Vulnerabilities (2026-03)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Veeam Backup &amp;amp; Replication is data protection software that supports image-level backup, recovery, and replication for&#xA;virtual, physical, and cloud machines.&#xA;&#xA;Multiple vulnerabilities have been identified across versions 12.3.x and 13.0.x that could allow for remote code&#xA;execution (RCE), privilege escalation, and credential theft.&#xA;&#xA;Version 12.3.x Vulnerabilities&#xA;- CVE-2026-21666 &amp;amp; CVE-2026-21667: Allows a remote, low-privileged authenticated domain user to perform RCE on the&#xA;Backup Server.&#xA;- CVE-2026-21668: Allows a remote, low-privileged authenticated domain user to bypass restrictions and manipulate&#xA;arbitrary files on a Backup Repository.&#xA;&#xA;Version 13.0.x Vulnerabilities&#xA;- CVE-2026-21669: Allows a remote, low-privileged authenticated domain user to perform RCE on Windows-based Backup&#xA;Servers.&#xA;- CVE-2026-21670: Allows a remote, low-privileged user to extract saved SSH credentials from Windows-based servers or&#xA;the Veeam Software Appliance.&#xA;- CVE-2026-21671: Allows a remote, high-privileged user with the &amp;#34;Backup Administrator&amp;#34; role to perform RCE in high&#xA;availability (HA) deployments.&#xA;&#xA;Vulnerabilities Affecting Both 12.3.x and 13.0.x&#xA;- CVE-2026-21672: A vulnerability allowing local privilege escalation on Windows-based Backup Servers.&#xA;- CVE-2026-21708: Allows a remote, low-privileged user with the &amp;#34;Backup Viewer&amp;#34; role to perform RCE as the `postgres`&#xA;user.&#xA;&#xA;The following versions are affected&#xA;- Veeam Backup &amp;amp; Replication versions 12.3.x prior to 12.3.2.4465&#xA;- Veeam Backup &amp;amp; Replication versions 13.0.x prior to 13.0.1.2067&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;vendor:=Veeam AND (product:=&amp;#34;Backup &amp;amp; Replication&amp;#34; OR product:=&amp;#34;Veeam Backup &amp;amp; Replication&amp;#34;) AND ((version:&amp;gt;=12.3 AND version:&amp;lt;12.3.2.4465) OR (version:&amp;gt;=13.0 AND version:&amp;lt;13.0.1.2067))&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: software · Category: Vulnerability · Severity: Critical&lt;/p&gt;</description>
      <pubDate>Thu, 12 Mar 2026 20:11:54 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#402713f0-c45e-4721-8919-276b9fda8779</guid>
    </item>
    <item>
      <title>[Vulnerability] Cisco Secure Firewall Management Center Multiple Vulnerabilities (2026-03)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;Cisco Secure Firewall Management Center (FMC) is a centralized administrative platform used to configure security&#xA;policies, manage firmware updates, and aggregate threat telemetry across physical and virtual Cisco security&#xA;appliances from a single interface.&#xA;&#xA;Certain versions of Cisco FMC are affected by the following vulnerabilities:&#xA;&#xA;- CVE-2026-20079: The Cisco FMC web interface contains an authentication bypass vulnerability stemming from an&#xA;improper system process created at boot time. A remote, unauthenticated adversary could exploit this by sending&#xA;crafted HTTP requests, allowing them to bypass authentication and execute script files or commands to obtain root&#xA;access to the underlying operating system.&#xA;&#xA;- CVE-2026-20131: The Cisco FMC web-based management interface contains a remote code execution (RCE) vulnerability&#xA;due to insecure deserialization of a user-supplied Java byte stream. A remote, unauthenticated adversary could exploit&#xA;this by sending a crafted serialized Java object to the interface, allowing them to execute arbitrary code and elevate&#xA;privileges to root. Note: Deployments where the management interface lacks public Internet access significantly reduce&#xA;the associated attack surface.&#xA;&#xA;There is evidence that CVE-2026-20131 is being actively *exploited in the wild*.&#xA;&#xA;The following versions of Cisco FMC are affected by one or both vulnerabilities:&#xA;- Cisco FMC versions prior to 7.0.9&#xA;- Cisco FMC versions prior to 7.2.11&#xA;- Cisco FMC versions prior to 7.4.4 (CVE-2026-20079) and prior to 7.4.6 (CVE-2026-20131) &#xA;- Cisco FMC versions prior to 7.6.4 (CVE-2026-20079) and prior to 7.6.5 (CVE-2026-20131)&#xA;- Cisco FMC versions prior to 7.7.12&#xA;- Cisco FMC versions prior to 10.0.1 (CVE-2026-20131 only)&#xA;&#xA;This has been given a severity of *Critical* because&#xA;- Successful exploitation would allow an adversary to execute arbitrary code on the vulnerable system.&#xA;&#xA;This has been given a risk of *Critical* because&#xA;- Exploitation of this vulnerability does not require authentication.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;os:=&amp;#34;Cisco FMC%&amp;#34; AND os_version:&amp;gt;0 AND ((os_version:&amp;gt;=&amp;#34;6.4.0.13&amp;#34; AND os_version:&amp;lt;=&amp;#34;6.4.0.18&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;7.0.0&amp;#34; AND os_version:&amp;lt;&amp;#34;7.0.9&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;7.1.0&amp;#34; AND os_version:&amp;lt;&amp;#34;7.2.11&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;7.3.0&amp;#34; AND os_version:&amp;lt;&amp;#34;7.4.6&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;7.6.0&amp;#34; AND os_version:&amp;lt;&amp;#34;7.6.5&amp;#34;) OR (os_version:&amp;gt;=&amp;#34;7.7.0&amp;#34; AND os_version:&amp;lt;&amp;#34;7.7.12&amp;#34;) OR (os_version:=&amp;#34;10.0.0&amp;#34;))&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Vulnerability · Severity: Critical&lt;/p&gt;</description>
      <pubDate>Thu, 05 Mar 2026 15:39:29 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#63d2107b-5141-43fa-87b1-06f754c0f431</guid>
    </item>
    <item>
      <title>[Compliance] CISA BOD 26-02 End-Of-Support Edge Devices</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;The indicated asset is an End-of-Support (EOS) device deployed on the &amp;#34;edge&amp;#34; or exposed to the public Internet.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;(os_eol_extended:&amp;gt;0 AND os_eol_extended:&amp;lt;=now) AND has_public:t AND NOT (type:Server OR type:Desktop OR type:Laptop)&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Compliance · Severity: Critical&lt;/p&gt;</description>
      <pubDate>Tue, 24 Feb 2026 21:04:50 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#e7c7db9d-2de1-4475-ae8a-3e342aa3a152</guid>
    </item>
    <item>
      <title>[Vulnerability] Grandstream GXP1600 Series VoIP Phone RCE (CVE-2026-2329)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;The Grandstream GXP1600 series is a collection of entry-level, Linux-based Voice over Internet Protocol (VoIP) phones&#xA;used for making and receiving voice calls over a network via the Session Initiation Protocol (SIP).&#xA;&#xA;Certain versions of the Grandstream GXP1600 series Voice over Internet Protocol (VoIP) phones contain a stack-based&#xA;buffer overflow vulnerability in the HTTP API endpoint `/cgi-bin/api.values.get`. Successful exploitation could allow&#xA;a remote, unauthenticated adversary achieve remote code execution (RCE) with root privileges on the phone.&#xA;&#xA;The following models and versions are affected&#xA;- GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630 firmware versions prior to 1.0.7.81&#xA;&#xA;This vulnerability has been given a severity of *Critical* because&#xA;- Successful exploitation would allow an adversary to execute arbitrary code on the vulnerable system.&#xA;&#xA;This vulnerability has been given a risk of *Critical* because&#xA;- Exploitation of this vulnerability does not require authentication.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;hw:=&amp;#34;Grandstream GXP16__&amp;#34; AND (os_version:&amp;gt;0 AND os_version:&amp;lt;&amp;#34;1.0.7.81&amp;#34;)&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: assets · Category: Vulnerability · Severity: Critical&lt;/p&gt;</description>
      <pubDate>Thu, 19 Feb 2026 22:51:03 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#d7987d92-46ab-497f-88d1-9fbe53be0744</guid>
    </item>
    <item>
      <title>[Vulnerability] IPMI RAKP+ Password Hash Disclosure (CVE-2013-4786)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;The Intelligent Platform Management Interface (IPMI) is a commonly-implemented protocol suite used by Baseboard Management Controllers (BMCs) for out-of-band &#xA;management of computer systems. BMCs that implement IPMI include SuperMicro (IPMI), Lenovo (XCC), Dell (DRAC), HP (iLO), and many others. The IPMI protocol&#xA;suite includes a sub-protocol called the Remote Authenticated Key-Exchange Protocol (RAKP). RAKP supports HMAC-based authentication, but does so in a way &#xA;where the BMC will send the expected HMAC hash to the user, prior to authentication.&#xA;&#xA;This pre-authentication exposure enables an attacker to obtain the HMAC hash of the target user accounts, which can be cracked offline to obtain&#xA;the clear-text password. The attacker needs to know a valid username, but this is often trivial to guess because most BMCs have one or more default&#xA;accounts with well-known usernames (e.g. &amp;#34;admin&amp;#34;).  An attacker that is able to obtain and crack the HMAC hash can use this to access the BMC as an&#xA;administrative user, which in turn allows them to reflash malicious firmware, dump clear-text passwords of configured users, and attack the host system &#xA;through various means, including the use of Keyboard Video Mouse (KVM) redirection.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;_asset.protocols:ipmi AND has:ipmi.rakp.hashes&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: services · Category: Vulnerability · Severity: High&lt;/p&gt;</description>
      <pubDate>Mon, 09 Feb 2026 03:48:45 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#157d1998-ee21-481e-998d-626aa472ea4e</guid>
    </item>
    <item>
      <title>[Vulnerability] IPMI RAKP+ Weak Or Default Passwords (CVE-2013-4786)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;The Intelligent Platform Management Interface (IPMI) is a commonly-implemented protocol suite used by Baseboard Management Controllers (BMCs) for out-of-band &#xA;management of computer systems. BMCs that implement IPMI include SuperMicro (IPMI), Lenovo (XCC), Dell (DRAC), HP (iLO), and many others. The IPMI protocol&#xA;suite includes a sub-protocol called the Remote Authenticated Key-Exchange Protocol (RAKP). RAKP supports HMAC-based authentication, but does so in a way &#xA;where the BMC will send the expected HMAC hash to the user, prior to authentication.&#xA;&#xA;This pre-authentication exposure enables an attacker to obtain the HMAC hash of the target user accounts, which can be cracked offline to obtain&#xA;the clear-text password. The attacker needs to know a valid username, but this is often trivial to guess because most BMCs have one or more default&#xA;accounts with well-known usernames (e.g. &amp;#34;admin&amp;#34;).  An attacker that is able to obtain and crack the HMAC hash can use this to access the BMC as an&#xA;administrative user, which in turn allows them to reflash malicious firmware, dump clear-text passwords of configured users, and attack the host system &#xA;through various means, including the use of Keyboard Video Mouse (KVM) redirection.&#xA;&#xA;The affected systems have RAKP enabled and have at least one user account with a default or weak password.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;_asset.protocols:ipmi AND has:ipmi.rakp.cracked&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: services · Category: Vulnerability · Severity: Critical&lt;/p&gt;</description>
      <pubDate>Mon, 09 Feb 2026 03:48:45 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#7af2cf1a-2bdb-4939-b7ea-858335464575</guid>
    </item>
    <item>
      <title>[Vulnerability] IPMI Cipher Zero Authentication Bypass (CVE-2013-4782)</title>
      <link>https://help.runzero.com/docs/em-queries/</link>
      <description>&lt;p&gt;The Intelligent Platform Management Interface (IPMI) is a commonly-implemented protocol used by Baseboard Management Controllers (BMCs) for out-of-band &#xA;management of computer systems. BMCs that implement IPMI include SuperMicro (IPMI), Lenovo (XCC), Dell (DRAC), HP (iLO), and many others. The IPMI protocol&#xA;includes multiple cipher suites for authentication, including one called &amp;#34;Cipher Zero&amp;#34; that is effectively unauthenticated access.&#xA;&#xA;This Cipher Zero vulnerability (CVE-2013-4782) allows an attacker to bypass authentication and gain unauthorized access to the BMC. An attacker that can &#xA;compromise a BMC can reflash malicious firmware, dump clear-text passwords of configured users, and attack the host system through various means,&#xA;including the use of Keyboard Video Mouse (KVM) redirection.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Query:&lt;/strong&gt; &lt;code&gt;_asset.protocols:ipmi AND has:ipmi.cipherZero&lt;/code&gt;&lt;/p&gt;&lt;p&gt;Type: services · Category: Vulnerability · Severity: Critical&lt;/p&gt;</description>
      <pubDate>Mon, 09 Feb 2026 03:48:45 +0000</pubDate>
      <guid>https://help.runzero.com/docs/em-queries/#a5e72e52-fe43-4539-8f9c-f06435cda771</guid>
    </item>
  </channel>
</rss>