1
CVEs
0
Critical
1
High
0
KEV
1
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (5)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-55839 | Stored cross-site scripting in Kestra's custom Markdown renderer (versions before 1.3.24) allows any authenticated user with Flow create or edit permissions to inject arbitrary JavaScript event-handler attributes via the platform's own [[link]] syntax, executing attacker-controlled code in the browser of any user who views the affected Flow description. The CVSS scope change (S:C) reflects that the payload crosses from the attacker's permission context into the victim's browser session, enabling session hijacking or privilege escalation against higher-privileged reviewers. A working proof-of-concept is publicly confirmed in GHSA-34pm-923j-7wf8; no active exploitation via CISA KEV is listed at time of analysis. | HIGH | 8.7 | 0.3% | 44 |
PoC
|