Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Windmill Labs Component: Windmill Clear all filters
TI-2026-18211 CVE-2026-22683 · GHSA-9q9g-rp9x-244h

Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

Priority HIGH 73

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.02609 Published 2026-04-07 Fixed in 1.615.0 CWE-862
TI-2026-26239 CVE-2026-33881

Code injection in windmill

Priority HIGH 67

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs.

CVSS 4.0HIGH 7.3 Network High privileges No interaction EPSS 0.00393 Published 2026-03-27 Fixed in 1.664.0 CWE-94