Login Request a demo
WI
Product
windmill
by windmill-labs · last CVE Aug 20, 2026
8
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Vulnerabilities8In the news1Timeline
Severity mix
Critical 0High 3Medium 4Low 1
Severity
All severities8Critical0High3Medium4Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add windmill to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-47107
8.1
0%
May 19
Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration
Affected: before 1.703.2
CVE-2026-29059
7.5
3%
Mar 6
Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly
Affected: < 1.603.3
CVE-2026-33881
7.2
0%
Mar 27
Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor
Affected: < 1.664.0
CVE-2026-72541
6.5
0%
Aug 11
Windmill Labs Windmill - Missing Authorization
Affected: through 1.783.0
CVE-2026-72539
6.5
0%
Aug 11
Windmill Labs Windmill - Information Disclosure
Affected: through 1.783.0
CVE-2026-72542
5.4
0%
Aug 11
Windmill Labs Windmill - Missing Authorization
Affected: through 1.783.0
CVE-2026-54136
5.1
0%
Aug 20
Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search
Affected: < 1.715.0
CVE-2026-26964
2.7
0%
Feb 19
Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members
Affected: < 1.635.0
Showing 8