K
Vendor security profile
Kong
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs4
Critical0
CISA KEV0
Public exploit0
Patch rate%25
Avg. CVSS6.3
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
1
2
1
CVE KEV
CVE severity distribution
4toplam CVE
High3 (75%)
Low1 (25%)
Patch and exploitation view
%25
Verified patch
%0
CISA KEV
%0
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
3Unknown
Latest vulnerabilities
7.5
CVE-2026-1907
SQL Injection in Clustering Communication (Hybrid Mode)
K
Patch status unknown
8.7
CVE-2026-108708
Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil
W
Patch status unknownEPSS %0
9.3
CVE-2026-108707
Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect
W
Patch status unknownEPSS %1
5.3
CVE-2026-108689
Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send
W
Patch status unknownEPSS %0
7.7
CVE-2026-14916
Kong API Gateway Enterprise: JWT Algorithm-Confusion
K
Patch status unknownEPSS %1
7.7
CVE-2026-14917
Kong API Gateway Enterprise: SAML Authentication bypass
K
Patch verifiedEPSS %1
7.0
CVE-2026-18674
Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier
KI
Patch verifiedEPSS %1
5.8
CVE-2026-18679
Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured
KI
Patch verifiedEPSS %0
5.5
CVE-2026-18678
Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured
KI
Patch verifiedEPSS %0
6.0
CVE-2026-18677
Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity
KI
Patch verifiedEPSS %0