...[ More ]

There is a critical authentication bypass vulnerability residing within Kestra OSS's core request-filtering mechanism. Due to insecure suffix-matching logic instead of strict routing or exact segment validation, attackers can craft custom request paths that bypass security controls. This allows...

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-9586link is external Sangoma Switchvox SQL Injection Vulnerability CVE-2026-48710link is external Kludex Starlette HTTP Request/Response Smuggling...

Kestra OSS OS Command Injection Vulnerability

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials...