CVE-2026-61682Critical 9.9kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace0.4%
CVE-2026-39429High 8.2kcp's cache server is accessible without authentication or authorization checks0.4%
CVE-2025-29922Critical 9.6kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace0.4%