Aakuity

Products

Exploited and recent CVEs

• CVE-2026-61850 Critical 9.3 Kargo: Privilege escalation via Project RBAC management in the Kargo API 0.4%
• CVE-2026-42350 Medium 5.1 Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter 0.3%
• CVE-2026-32828 Medium 5.1 Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration 0.3%
• CVE-2026-27112 Critical 9.4 Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints 0.5%
• CVE-2026-27111 Medium 5.3 Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints 0.2%
• CVE-2026-24748 Medium 6.9 Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access 0.4%