WI
Vendor
windmill-labs
12
CVEs
0
On KEV
0
New 30D
Products
WI8.1
windmill
windmill-labs
8 CVEs0 on KEV0 new
WC9.9
Windmill CE (Community Edition)
Windmill Labs
2 CVEs0 on KEV0 new
WE9.9
Windmill EE (Enterprise Edition)
Windmill Labs
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-54136 | WI windmill windmill-labs | 5.1 | Aug 20 | Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search |
| CVE-2026-72542 | WI Windmill Windmill Labs | 5.4 | Aug 11 | Windmill Labs Windmill - Missing Authorization |
| CVE-2026-72541 | WI Windmill Windmill Labs | 6.5 | Aug 11 | Windmill Labs Windmill - Missing Authorization |
| CVE-2026-72539 | WI Windmill Windmill Labs | 6.5 | Aug 11 | Windmill Labs Windmill - Information Disclosure |
| CVE-2026-47107 | WI windmill windmill-labs | 8.1 | May 19 | Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration |
| CVE-2026-23696 | WC Windmill CE (Community Edition) Windmill Labs | 9.9 | Apr 7 | Windmill < 1.603.3 File Ownership Handling SQLi RCE |
| CVE-2026-22683 | WE Windmill EE (Enterprise Edition) Windmill Labs | 8.8 | Apr 7 | Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE |
| CVE-2026-33881 | WI windmill windmill-labs | 7.2 | Mar 27 | Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor |
| CVE-2026-29059 | WI windmill windmill-labs | 7.5 | Mar 6 | Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly |
| CVE-2026-26964 | WI windmill windmill-labs | 2.7 | Feb 19 | Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members |