K
Vendor security profile1 actively exploited CVEs
kestra
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs12
Critical4
CISA KEV1
Public exploit11
Patch rate%25
Avg. CVSS8.4
12-month vulnerability rate
0
0
0
0
0
1
1
6
0
4
0
0
CVE KEV
CVE severity distribution
12toplam CVE
Critical4 (33%)
High6 (50%)
Medium2 (17%)
Patch and exploitation view
%25
Verified patch
%8
CISA KEV
%92
Public exploit
3Patch available
0Partial
0Workaround
0Vendor: no patch
9Unknown
Latest vulnerabilities
8.7
CVE-2026-55839
Kestra: Stored XSS via custom Markdown [[link]] attribute injection
K
Patch verifiedEPSS %0
8.6
CVE-2026-73247
Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
K
Patch status unknownEPSS %0
7.5
CVE-2026-73246
Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials
K
Patch status unknownEPSS %1
6.5
CVE-2026-73245
Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
K
Patch verifiedEPSS %0
10.0
CVE-2026-49869 Actively exploited
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
K
Patch status unknownEPSS %2
8.7
CVE-2026-55069
Vulnerability in Kestra
K
Patch status unknownEPSS %0
6.5
CVE-2026-53577
Incorrect authorization in Kestra
K
Patch status unknownEPSS %0
10.0
CVE-2026-53576
Code injection in Kestra
K
Patch status unknownEPSS %3
7.7
CVE-2026-49984
Path traversal in Kestra
K
Patch status unknownEPSS %1
7.7
CVE-2026-45807
Path traversal in Kestra
K
Patch status unknownEPSS %1