Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Aug 18, 2026Kestra is an open-source, event-driven orchestration platform.CVE-2026-55839 · Other software · kestra-io · reported by GitHubHigh 8.7
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Kestra is an open-source, event-driven orchestration platform.CVE-2026-73247 · Other software · kestra-io · reported by GitHubHigh 8.6
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Kestra is an open-source, event-driven orchestration platform.CVE-2026-73246 · Other software · kestra-io · reported by GitHubHigh 7.5
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Kestra is an open-source, event-driven orchestration platform.CVE-2026-73245 · Other software · kestra-io · reported by GitHubMedium 6.5
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Kestra is an open-source, event-driven orchestration platform.CVE-2026-55069 · Other software · kestra-io · reported by GitHubHigh 8.7
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Kestra is an open-source, event-driven orchestration platform.CVE-2026-53577 · Other software · kestra-io · reported by GitHubMedium 6.5
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) contains an access control bypass that allows any authenticated user to read output files from any other execution within the same tenant, bypassing execution-level and namespace-level isolation. This vulnerability is fixed in 1.0.45 and 1.3.21.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Kestra is an open-source, event-driven orchestration platform.CVE-2026-53576 · Other software · kestra-io · reported by GitHubCritical 10
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresses its resources by URL path segments that the caller chooses (/api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, /api/v1/{tenant}/namespaces/{namespace}/kv/{key}). An anonymous caller picks the literal configs as the final segment, and the request bypasses Basic-Auth entirely. Because the bypass reaches the flow-create and execution-trigger routes, an unauthenticated caller creates a flow containing a Shell or Process task and runs it. The task executes as root inside the kestra container. The official docker-compose.yml mounts /var/run/docker.sock, so root in the container reaches the host Docker daemon. This vulnerability is fixed in 1.0.45 and 1.3.21.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Kestra is an open-source, event-driven orchestration platform.CVE-2026-49984 · Other software · kestra-io · reported by GitHubHigh 7.7
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can therefore smuggle a traversal sequence past the guard using backslashes (..\..\..\); the guard sees a harmless string, and the path is only rewritten to ../../../ after validation, immediately before the file is opened. Any authenticated user who can view an execution (the lowest-privilege role) can call GET /api/v1/{tenant}/executions/{executionId}/file?path=… and read any file on the server filesystem readable by the Kestra process, outside the storage sandbox and across every tenant and namespace. This includes the embedded H2 database (all flows, all users, all stored secrets), internal storage of every other tenant/namespace, mounted secret files, and the process environment (/proc/self/environ) which contains configured database and secret-backend credentials. It is a complete breach of Kestra's storage isolation and multi-tenancy boundary. This vulnerability is fixed in 1.0.45 and 1.3.23.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Kestra OSS OS Command Injection VulnerabilityCVE-2026-49869 · Other software · Kestra · reported by GitHubExploitedCritical 10
Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.
- Product
- Kestra OSS
- On CISA’s list since
- Sep 2, 2026 (federal fix deadline Sep 5, 2026)
- What to do
- Attackers are using this now. Install Kestra’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Jun 26, 2026Kestra is an open-source, event-driven orchestration platform.CVE-2026-45807 · Other software · kestra-io · reported by GitHubHigh 7.7
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from the local storage backend. The guard only inspects the literal URI.toString(), so a URL-encoded .. written as %2E%2E slips through. The downstream code then calls URI.getPath(), which decodes %2E%2E back to .., and the resulting path is handed to Paths.get(...) without normalization. The OS resolves the .. segments at open(2) time, so an authenticated user with a single execution can read any file the Kestra process has access to on the host filesystem (/etc/passwd, mounted secrets, other tenants' execution outputs, etc.). This vulnerability is fixed in 1.0.43 and 1.3.19.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2026Kestra is an open-source, event-driven orchestration platform.CVE-2026-48129 · Other software · kestra-io · reported by GitHubMedium 6.5
Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kestra task `inputFiles` writes rendered file names directly under the task working directory. When a flow forwards untrusted execution or webhook data into an `inputFiles` file name, a caller can use `../` path segments to create or overwrite files outside that task working directory on the worker filesystem. Versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43 patch the issue.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026Kestra v1.3.3 and before is vulnerable to SQL Injection.CVE-2026-38428 · Other software · Kestra · reported by MITRECritical 9.8
Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization. As a result, attackers can inject arbitrary SQL expressions into the database query.
- Product
- Kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Kestra is an open-source, event-driven orchestration platform.CVE-2026-34612 · Other software · kestra-io · reported by GitHubCritical 9.9
Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied flow YAML metadata fields — description, iCVE-2026-33664 · Other software · kestra-io · reported by GitHubHigh 7.3
Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied flow YAML metadata fields — description, inputs[].displayName, inputs[].description — through the Markdown.vue component instantiated with html: true. The resulting HTML is injected into the DOM via Vue's v-html without any sanitization. This allows a flow author to embed arbitrary JavaScript that executes in the browser of any user who views or interacts with the flow. This is distinct from GHSA-r36c-83hm-pc8j / CVE-2026-29082, which covers only FilePreview.vue rendering .md files from execution outputs. The present finding affects different components, different data sources, and requires significantly less user interaction (zero-click for input.displayName). As of time of publication, it is unclear if a patch is available.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026Kestra is an event-driven orchestration platform.CVE-2026-29082 · Other software · kestra-io · reported by GitHubHigh 7.3
Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown (.md) with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanitisation. At time of publication, there are no publicly available patches.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025Kestra is an event-driven orchestration platform.CVE-2025-53543 · Other software · kestra-io · reported by GitHubMedium 4.2
Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received. This vulnerability is fixed in 0.22.0.
- Product
- kestra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2022Orckestra C1 CMS is a .NET based Web Content Management System.CVE-2022-39256 · Other software · Orckestra · reported by GitHubCritical 9
Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.
- Product
- C1-CMS-Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022C1 CMS is an open-source, .NET based Content Management System (CMS).CVE-2022-24789 · Other software · Orckestra · reported by GitHubHigh 7.6
C1 CMS is an open-source, .NET based Content Management System (CMS). Versions prior to 6.12 allow an authenticated user to exploit Server Side Request Forgery (SSRF) by causing the server to make arbitrary GET requests to other servers in the local network or on localhost. The attacker may also truncate arbitrary files to zero size (effectively delete them) leading to denial of service (DoS) or altering application logic. The authenticated user may unknowingly perform the actions by visiting a specially crafted site. Patched in C1 CMS v6.12, no known workarounds exist.
- Product
- C1-CMS-Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10.CVE-2021-34992 · Other software · Orckestra · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10. Authentication is required to exploit this vulnerability. The specific flaw exists within Composite.dll. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-14740.
- Product
- C1 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Dec 23, 2019An issue was discovered in Orckestra C1 CMS through 6.6.CVE-2019-18211 · Other software · Orckestra · reported by MITREHigh 8.8
An issue was discovered in Orckestra C1 CMS through 6.6. The EntityTokenSerializer class in Composite.dll is prone to unvalidated deserialization of wrapped BinaryFormatter payloads, leading to arbitrary remote code execution for any low-privilege user.
- Product
- C1 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.