# Temporal Cloud CVEs > Temporal Cloud: 19 CVEs mapped to its software or packages (0 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/temporal-cloud/cves Last updated: 2026-10-15T19:09:30Z 19 CVEs map to Temporal Cloud (0 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [Temporal Cloud](https://rewindex.com/company/temporal-cloud.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that Temporal Cloud’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-15 | [CVE-2026-108126](https://rewindex.com/cve/CVE-2026-108126.md) | temporal-proxy payload decryption is not bound to the request namespace | 6.0 medium | | | 2026-10-12 | [CVE-2026-89140](https://rewindex.com/cve/CVE-2026-89140.md) | Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state | 6.0 medium | | | 2026-10-12 | [CVE-2026-104355](https://rewindex.com/cve/CVE-2026-104355.md) | Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces | 7.0 high | | | 2026-09-23 | [CVE-2026-96770](https://rewindex.com/cve/CVE-2026-96770.md) | s2s-proxy accepts untrusted client certificates | 9.3 critical | | | 2026-09-21 | [CVE-2026-89139](https://rewindex.com/cve/CVE-2026-89139.md) | Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host | 8.7 high | | | 2026-09-21 | [CVE-2026-87858](https://rewindex.com/cve/CVE-2026-87858.md) | Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization | 7.2 high | | | 2026-09-21 | [CVE-2026-65654](https://rewindex.com/cve/CVE-2026-65654.md) | temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip | 8.7 high | | | 2026-09-21 | [CVE-2026-65653](https://rewindex.com/cve/CVE-2026-65653.md) | temporalio/tchannel-go zero-chunk call fragment causes process termination | 8.7 high | | | 2026-09-21 | [CVE-2026-65652](https://rewindex.com/cve/CVE-2026-65652.md) | temporalio/tchannel-go malformed checksum type causes process termination | 8.7 high | | | 2026-09-21 | [CVE-2026-65651](https://rewindex.com/cve/CVE-2026-65651.md) | temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal | 8.7 high | | | 2026-09-21 | [CVE-2026-16651](https://rewindex.com/cve/CVE-2026-16651.md) | temporalio/sqlparser malformed MySQL version comments can cause a panic | 8.7 high | | | 2026-09-21 | [CVE-2026-16652](https://rewindex.com/cve/CVE-2026-16652.md) | Temporal Server Schedule exclusion search can cause excessive CPU consumption | 7.1 high | | | 2026-08-11 | [CVE-2026-65655](https://rewindex.com/cve/CVE-2026-65655.md) | Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy | 2.3 low | | | 2026-04-10 | [CVE-2026-5724](https://rewindex.com/cve/CVE-2026-5724.md) | Missing Authentication on Streaming gRPC Replication Endpoint | 6.3 medium | | | 2026-04-01 | [CVE-2026-5199](https://rewindex.com/cve/CVE-2026-5199.md) | Cross Namespace Access via Batch Operation | 2.3 low | | | 2025-12-30 | [CVE-2025-14986](https://rewindex.com/cve/CVE-2025-14986.md) | ExecuteMultiOperation Namespace Policy Bypass | 1.3 low | | | 2025-12-30 | [CVE-2025-14987](https://rewindex.com/cve/CVE-2025-14987.md) | Cross Namespace Commands Authorization Bypass | 5.3 medium | | | 2025-09-15 | [CVE-2025-8396](https://rewindex.com/cve/CVE-2025-8396.md) | | 6.9 medium | | | 2025-02-12 | [CVE-2025-1243](https://rewindex.com/cve/CVE-2025-1243.md) | Field in api-go proxy not transformed before version 1.44.1 | 2.0 low | | --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (Temporal Cloud) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 1 | 1 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 1 | 0 | 0 | | 2026-04-06 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-04-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-11 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 0 | 0 | 0 | 1 | 0 | 0 | | 2026-08-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-31 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-07 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-14 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-21 | 1 | 8 | 0 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-12 | 0 | 1 | 2 | 0 | 0 | 0 | | 2026-10-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/temporal-cloud/cves · Markdown: https://rewindex.com/company/temporal-cloud/cves.md · JSON: https://rewindex.com/api/v1/companies/temporal-cloud/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:44:06.190Z