Vulnerabilities · Kestrel Systems GmbH (Demo)

All 5 Actively exploited 3 No fix yet 2

Vulnerability	Product	Severity	Exploited	Discovered (UTC)	Fix available (UTC)	Disclosure
Authentication bypass on the management APICVE-2026-31887	Kestrel Gateway	critical	yes	2026-11-11 18:37	2026-11-13 04:37	coordinated
Memory corruption in the TLS stackCVE-2026-32004	Kestrel Gateway	critical	yes	2026-11-10 10:37	none — the 14-day clock cannot start	private
Deserialization flaw in bundled libsignalprocCVE-2026-30112	Kestrel Gateway	high	yes	2026-11-08 10:37	none — the 14-day clock cannot start	public
Unthrottled login endpointKES-2026-006	Customer support portal	medium	no	2026-11-04 10:37	2026-11-05 12:37	private
Stored XSS in the console audit viewKES-2026-004	Kestrel Cloud Console	medium	no	2026-10-19 10:37	2026-10-27 18:37	private

Log a vulnerability

Title

Identifier

Product

Severity

What it is

Discovered (Europe/Berlin)

Corrective or mitigating measure available (Europe/Berlin)

Leave blank until it exists. This is what starts the CRA's 14-day final report.

Actively exploited. If the product is in CRA scope, this is a reportable event: open an incident and the 24-hour early warning runs from the moment you became aware.

Disclosure

Linked incident

Remediation note