CVE-2026-73245: Missing Authentication for Critical Function

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2025-25586: Insertion of Sensitive Information into Externally-Accessible File or Directory

yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml...