Vendor
Kong Inc.
8 known vulnerabilities in products by Kong Inc., 0 of them actively exploited (CISA KEV).
Key figures
8
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-1087 | Arbitrary Code Execution in Kong Insomnia Desktop Application | — | |
| High | CVE-2026-18674 | Kong Mesh: Insufficient Verification of Data Authenticity | — | |
| Medium | CVE-2026-18677 | Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity | — | |
| Medium | CVE-2026-18675 | Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid | — | |
| Medium | CVE-2026-18673 | Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication | — | |
| Medium | CVE-2026-18676 | Kong Mesh: Permissive Cross-domain Security Policy with Untrusted Domains | — | |
| Medium | CVE-2026-18679 | Kong Mesh: Improper Certificate Validation | — | |
| Medium | CVE-2026-18678 | Kong Mesh: Improper Certificate Validation | — |
Products
| Kong Mesh | 7 | 0 |