KE
Vendor
Kestra
11
CVEs
2
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-49869 In wildKEV | KE Kestra Kestra | 10.0 | Jun 26 | Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter` |
| CVE-2026-45807 | KE Kestra Kestra | 7.7 | Jun 26 | Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read |
| CVE-2026-49984 | KE Kestra Kestra | 7.7 | Jun 26 | Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard) |
| CVE-2026-53576 | KE Kestra Kestra | 10.0 | Jun 26 | Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass |
| CVE-2026-53577 | KE Kestra Kestra | 6.5 | Jun 26 | Kestra: Cross-Execution File Read via Preview Endpoint (IDOR) |
| CVE-2026-55069 | KE Kestra Kestra | 8.7 | Jun 26 | Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack |
| CVE-2026-38428 | KE Kestra Kestra | 9.8 | May 5 | Kestra v1.3.3 and before is vulnerable to SQL Injection |
| CVE-2026-34612 | KE Kestra Kestra | 9.0 | Apr 3 | Kestra: Remote Code Execution via SQL Injection |
| CVE-2026-33664 | KE Kestra Kestra | 5.4 | Mar 26 | Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields |
| CVE-2026-29082 | KE Kestra Kestra | 5.4 | Mar 6 | Kestra: Stored Cross-Site Scripting in Markdown File Preview |