Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization. As a result, attackers can inject arbitrary SQL expressions into the database query.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-05 | 2 | Disclosure2 |
| 2026-05-06 | 1 | Disclosure1 |
| 2026-05-12 | 4 | Disclosure2General2 |
References CVE: CVE-2026-38428 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The text only provides basic CVE metadata without any indications of exploits, patches, or active attacks.
CRITICAL: CVE-2026-38428 (CVSS 9.8) — multiple products. CVE: CVE-2026-38428 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The text announces CVE‑2026‑38428 as a critical vulnerability with a CVSS 9.8 score; no PoC, exploit details, or mitigation steps are mentioned.
CVE: CVE-2026-38428 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory Kestra v1.3.3 and before is vulnerable to SQL Injection.
Post summary
Kestra v1.3.3 and earlier are vulnerable to SQL injection (CVE‑2026‑38428), a critical 9.8 CVSS vulnerability.
CVE-2026-38428 Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an … https://www.cve.org/CVERecord?id=CVE-2026-38428
Post summary
Kestra versions prior to 1.3.3 are vulnerable to SQL injection due to unsanitized GET parameter concatenation. No PoC, exploit code, or patch information is provided in the text.
https://lyrie.ai/research/research/cve-2026-38428-advisory #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The provided text references a CVE advisory but contains no detailed information, exploit code, or actionable guidance.
CVE-2026-38428 SQL Injection Vulnerability in Kestra v1.3.3 and Earlier Versions https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-38428
Post summary
A brief disclosure of CVE-2026-38428, an SQL injection vulnerability affecting Kestra v1.3.3 and earlier, with a link to a vulnerability detail page.
🚨*CVE* CVE-2026-38428 Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an … https://www.cve.org/CVERecord?id=CVE-2026-38428 ----- Traducción: CVE-2026-38428 Kes… http://infoflow.cloud`
Post summary
The post announces a SQL injection vulnerability in Kestra versions prior to 1.3.3, describing its technical cause and linking to the CVE record.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | kestra | kestra | - | - | - |