Vendor
Sentry-Javascript: Middleware bypass via tunnelRoute (CVE-2026-114139)
1 TTP 1 CVEA middleware bypass vulnerability in the @sentry/nextjs SDK allows unauthenticated access to routes if the configured tunnel path overlaps with application routes in Webpack-based builds.
Sentry 8.2.0 Remote Code Execution via Pickle Deserialization (CVE-2021-47935)
2 rules 1 TTP 1 CVESentry 8.2.0 contains a remote code execution vulnerability (CVE-2021-47935) that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects through the audit log entry data parameter via crafted POST requests to the admin audit log endpoint.
Sentry SAML SSO Improper Authentication Allows User Identity Linking
2 rules 1 TTPA critical vulnerability (CVE-2026-42354) exists in Sentry's SAML SSO implementation that allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance, affecting self-hosted users with multiple organizations configured if a malicious user has permissions to modify SSO settings, while Sentry SaaS was patched in April and self-hosted users are advised to upgrade to version 26.4.1 or higher.