Our news and updates

In Traefik versions 2.x prior to 2.11.60 and 3.x prior to 3.7.16 a high severity vulnerability CVE-2026-121966 was detected. This vulnerability allows an unauthenticated attacker to reuse another user’s authenticated connection to the ForwardAuth auth server, receive the victim’s identity, and access backends as that user. To address this issue, users should upgrade Traefik to version 2.11.60, 3.7.16, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-121966.

In Neo4j GraphQL Library versions 7.0.0 before 7.6.7 a high severity vulnerability CVE-2026-92683 was detected. This vulnerability allows an attacker holding an otherwise-valid JWT to bypass every filter condition except the first one in a multi-condition JWT where filter. To address this issue, users should upgrade Neo4j GraphQL Library to version 7.6.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-92683.

In Apache Airflow versions prior to 3.4.0 a high severity vulnerability CVE-2026-111421 was detected. This vulnerability allows a DAG author to write an XCom value that makes the API server instantiate airflow.* classes with attacker-chosen arguments when a user views it through the API with deserialization enabled. To address this issue, users should upgrade Apache Airflow to version 3.4.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-111421.

In SuiteCRM versions prior to 7.15.2 and 8.10.2 a high severity vulnerability CVE-2026-69140 was detected. This vulnerability allows a low-privileged user with Documents module access to disclose database data and mass-update linked documents records. To address this issue, users should upgrade SuiteCRM to version 7.15.2, 8.10.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-69140.

In Gridbox component for Joomla versions prior to 2.20.4.2 a critical severity vulnerability CVE-2026-102789 was detected. This vulnerability allows an attacker to call the editor’s getBlogPosts task, which lacks the edit-level permission check that other tasks in the same controller enforce. To address this issue, users should upgrade Gridbox to version 2.20.4.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-102789.

In Fiber Admin component for WordPress versions prior to 4.0.1 a critical severity vulnerability CVE-2026-121491 was detected. This vulnerability allows an unauthenticated attacker to execute arbitrary code on the server by injecting a crafted request header when the custom database error page is enabled. To address this issue, users should upgrade Fiber Admin to version 4.0.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-121491.

In Checkout Files Upload for WooCommerce component for WooCommerce versions prior to 2.4.0 a critical severity vulnerability CVE-2026-103688 was detected. This vulnerability allows an unauthenticated attacker to upload arbitrary files, including PHP files that can lead to remote code execution. To address this issue, users should upgrade Checkout Files Upload for WooCommerce to version 2.4.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-103688.

In All In One Login component for WordPress versions prior to 2.5.0 a critical severity vulnerability CVE-2026-19256 was detected. This vulnerability allows an unauthenticated attacker to brute-force the short numeric code of the passwordless email login and take over any account, including an administrator’s. To address this issue, users should upgrade All In One Login to version 2.5.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19256.

In JupyterLab Desktop versions prior to 4.6.2-1 a critical severity vulnerability CVE-2026-102530 was detected. This vulnerability allows an attacker to run JavaScript through a crafted remote-server URL and abuse the privileged IPC bridge to execute arbitrary code with the user’s privileges. To address this issue, users should upgrade JupyterLab Desktop to version 4.6.2-1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-102530.