Read the docs

Kiuwan

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

Kiuwan records in CISA KEV

No Kiuwan vulnerabilities are listed in CISA KEV.

Records

5 records

TI-2023-26775 CVE-2023-49110 · GHSA-55gj-hcpf-vg3h

XML External Entity Injection in Kiuwan SAST

Priority HIGH 67

When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application (either on-premises or cloud/SaaS solution), the transmitted data consists of a ZIP archive containing several files, some of the…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0082 Published 2024-06-20 No fix listed CWE-611
TI-2023-26777 CVE-2023-49112 · GHSA-m8h7-pff8-m5jq

Insecure Direct Object Reference in Kiuwan SAST

Priority MEDIUM 62

Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the "application" parameter.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00517 Published 2024-06-20 No fix listed CWE-639
TI-2023-26776 CVE-2023-49111 · GHSA-39wq-w29m-4ccv

Reflected Cross-Site-Scripting in Kiuwan SAST

Priority MEDIUM 62

For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html".

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00646 Published 2024-06-20 No fix listed CWE-79
TI-2026-19396 CVE-2026-24069 · GHSA-446f-x529-8hw2

Improper Enforcement of Disabled Accounts in WebUI SSO in Kiuwan SAST

Priority LOW 24

Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00189 Published 2026-04-14 Fixed in 2.8.2509.4 CWE-863
Open these records in search →