Our news and updates

In Royal Elementor Addons component for WordPress versions before 1.7.1067 a medium severity vulnerability CVE-2026-13407 was detected. This vulnerability allows unauthenticated attackers to inject arbitrary HTML into emails sent to the site administrator on form submission. To address this issue, users should upgrade Royal Elementor Addons to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-13407.

In Formidable Forms component for WordPress versions before 6.35 a medium severity vulnerability CVE-2026-19857 was detected. This vulnerability allows unauthenticated visitors to execute arbitrary shortcodes with chosen attributes on the server. To address this issue, users should upgrade Formidable Forms to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19857.

In Eventin component for WordPress versions before 4.1.24 a medium severity vulnerability CVE-2026-84906 was detected. This vulnerability allows unauthenticated visitors to mark unpaid orders of any value as paid. To address this issue, users should upgrade Eventin to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-84906.

In Appointment Hour Booking component for WordPress versions before 1.5.95 a medium severity vulnerability CVE-2026-86475 was detected. This vulnerability allows unauthenticated visitors to take slots that are already fully booked. To address this issue, users should upgrade Appointment Hour Booking to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-86475.

In GitLab versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 a low severity vulnerability CVE-2026-3855 was detected. This vulnerability allows an authenticated user with project-level permissions to access restricted file contents on the server or cause denial of service. To address this issue, users should upgrade GitLab to version 19.1.8 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3855.

In ngx_http_v3_module component for NGINX in certain versions a medium severity vulnerability CVE-2026-90439 was detected. This vulnerability allows for a potential limited heap buffer overflow while processing a TLS handshake. To address this issue, users should upgrade NGINX to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-90439.

In MotoPress Hotel Booking plugin component for WordPress versions 6.2.4 and earlier a high severity vulnerability CVE-2026-90650 was detected. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts. To address this issue, users should upgrade MotoPress Hotel Booking plugin to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-90650.

In Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 a high severity vulnerability CVE-2026-19407 was detected. This vulnerability allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft. To address this issue, users should upgrade the Google Cloud Gemini Enterprise Agent Platform SDK for Python to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19407.

In fluent-plugin-opentelemetry component for Fluentd versions prior to 0.5.3 a medium severity vulnerability CVE-2026-44163 was detected. This vulnerability allows attackers to cause resource exhaustion by sending a large, compressed payload. To address this issue, users should upgrade fluent-plugin-opentelemetry to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44163.