CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,151 CVEs published, 232 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,151
Show in the list
Critical, last 7 days
232
Show in the list
Healthcare-tagged, last 7 days
10
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product kestra_io:kestra. Show all products

14 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-55839High 8.7Kestra: Stored XSS via custom Markdown [[link]] attribute injection
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-73247High 8.6Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Assigned by GitHub_M
Aug 11, 2026
CVE-2026-73246High 7.5Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials
Assigned by GitHub_M
Aug 11, 2026
CVE-2026-73245Medium 6.5Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
Assigned by GitHub_M
Aug 11, 2026
CVE-2026-49869
Known exploited
Critical 10.0Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
Assigned by GitHub_M
Jun 26, 2026
CVE-2026-45807High 7.7Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read
Assigned by GitHub_M
Jun 26, 2026
CVE-2026-49984High 7.7Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)
Assigned by GitHub_M
Jun 26, 2026
CVE-2026-53576Critical 10.0Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
Assigned by GitHub_M
Jun 26, 2026
CVE-2026-53577Medium 6.5Kestra: Cross-Execution File Read via Preview Endpoint (IDOR)
Assigned by GitHub_M
Jun 26, 2026
CVE-2026-55069High 8.7Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack
Assigned by GitHub_M
Jun 26, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.