Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key.
CVSS 4.0CRITICAL 9.2·Network·No auth·No interaction·EPSS 0.00623·Published 2026-10-26·Fixed in 4.1.10CWE-321
Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters.
CVSS 4.0MEDIUM 6.9·Network·No auth·No interaction·EPSS 0.00331·Published 2026-10-02·Fixed in 4.1.6CWE-200