self-hosted
Kener's default secret signed everyone's session: CVE-2026-116747
Kener, the self-hosted status-page platform, fell back to a hardcoded placeholder secret when its signing key was unset. That one default let an attacker forge a valid admin session. Fixed in v4.1.10.