Security Advisories

This page lists vulnerability information and security notices related to Kuroco, together with whether Kuroco is affected and the current response status. For details of each advisory, see the linked notice. This page also shows whether Kuroco uses major software for which many vulnerabilities have been reported.

Status definitions

Status	Description
Investigating	We are investigating whether Kuroco is affected.
Affected	We have confirmed that Kuroco is affected and are working on a response.
Not affected	We have confirmed that Kuroco is not affected.
Resolved	The response on the Kuroco side has been completed.
Customer action recommended	We recommend that customers take action in their site settings or implementation.

Advisories

You can receive new and updated advisories via RSS. When the status of an advisory is updated, it is delivered as a new item.

Published	Last updated	Title	Type	Status
2026-10-30	2026-10-30	Response Status for the Linux Kernel Vulnerability (CVE-2026-98432)	Vulnerability	Investigating
2026-10-30	2026-10-30	Response Status for the Out-of-Bounds Write Vulnerability in the C Implementation of Brotli (CVE-2026-111497)	Vulnerability	Resolved
2026-10-30	2026-10-30	Response Status for Multiple Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)	Vulnerability	Resolved
2026-10-20	2026-10-20	Request to Take Measures Against Unauthorized Admin Panel Logins	Notice	Customer action recommended
2026-10-15	2026-10-15	Save Restrictions for Smarty Plugins That Handle Credentials and Secrets	Security enhancement	Resolved
2026-02-24	2026-04-22	Change in Email Two-Factor Authentication Behavior When Email Cannot Be Sent	Security enhancement	Resolved (applied in the 2026-04-22 stable release)
2025-04-22	2025-04-22	Access to files attached to members now requires authentication	Security enhancement	Resolved
2024-04-01	2024-07-16	Implementation of disabling cipher suite	Security enhancement	Resolved (applied in the 2024-07-16 stable release)
2024-03-30	2024-04-02	Notice on the Impact and Response Status Related to CVE-2024-3094 Affecting Kuroco	Vulnerability	Not affected

Usage of major software

This section shows whether Kuroco uses major software for which many vulnerabilities have been reported. For the response status of vulnerabilities in the software that Kuroco uses, see Advisories.

Major software in use

Software	Usage
nginx	Used
Envoy	Used
PHP	Used
PHP-FPM	Used
PostgreSQL	Used
Rust	Used
Go	Used for some features
Node.js	Used for some features (mainly related to KurocoFront) as a Google Cloud managed service

Major software not in use

Kuroco does not use the following software, which we are frequently asked about.

F5 BIG-IP, Fortinet FortiGate (FortiOS), Palo Alto Networks PAN-OS, Ivanti Connect Secure, Citrix NetScaler, Cisco ASA, SonicWall, VMware ESXi / vCenter, Microsoft Exchange Server, Microsoft SharePoint, Windows Server, Apache HTTP Server, Apache Tomcat, Apache Struts, Log4j, Java, Ruby, WordPress, Atlassian Confluence / Jira, MOVEit Transfer, GitLab

note

This list does not cover all software. For software not listed here, please contact support.

Contact

If you want to check whether Kuroco is affected by a vulnerability that is not listed here, please contact Kuroco support. Requests to check lists of CVEs that you send us periodically are quoted separately. For details, see Can I check whether Kuroco is affected by a specific vulnerability (CVE) or uses specific software?.

• Support

Related documents

• Security Center
• What vulnerability diagnostic and assessment services do you provide?
• Can you send me the findings from your vulnerability assessment?
• My site was diagnosed with a security vulnerability. What should I do?