In Dolibarr ERP CRM versions prior to 24.0.0 a high severity vulnerability CVE-2026-116219 was detected. This vulnerability allows an authenticated administrator to execute arbitrary operating system commands as the web server user. This occurs due to an OS command injection flaw within the htdocs/admin/tools/export.php script. An attacker can bypass the restrict_os_commands allowlist by submitting a manipulated mysqldump value, chaining malicious commands with & characters around an allowlisted basename. To address this issue, users should upgrade Dolibarr ERP CRM to version 24.0.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-116219.
In Joomla! versions from 4.0.0 before 5.4.8, and 6.0.0 before 6.1.3 a medium severity vulnerability CVE-2026-72532 was detected. This vulnerability allows an unauthorized user to create categories, leading to unwanted structural modifications on the site. This occurs due to improper Access Control List (ACL) checks within the category webservice endpoints. By sending requests directly to these APIs, an attacker can bypass the intended access restrictions and generate new categories without possessing the required permissions. To address this issue, users should upgrade Joomla! to versions 5.4.8, 6.1.3, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-72532.
Read more CMS
In Directus versions prior to 11.13.0 a medium severity vulnerability CVE-2025-64748 was detected. This vulnerability allows an authenticated user to perform enumeration attacks and deduce the contents of concealed or sensitive fields. This occurs because concealed fields remain searchable if the user has read permissions for them. Although the actual values of these fields are properly masked (e.g., displaying as ****) in the application’s response, successful search queries still return the corresponding records. By systematically adjusting search parameters and observing which queries yield results, an attacker can brute-force and uncover the hidden data. To address this issue, users should upgrade Directus to version 11.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64748.
In FreeScout versions prior to 1.8.186 a high severity vulnerability CVE-2025-58163 was detected. This vulnerability allows an authenticated attacker with knowledge of the application’s APP_KEY to achieve Remote Code Execution (RCE). This occurs due to the deserialization of untrusted data during the decryption process. When specific endpoints, such as /help/{mailbox_id}/auth/{customer_id}/{hash}/{timestamp}, process the customer_id and timestamp parameters, they are passed through the decrypt function in app/Helper.php without proper validation. Because the application subsequently deserializes the decrypted payload without sanitization, an attacker can craft malicious serialized PHP objects to trigger arbitrary command execution. To address this issue, users should upgrade FreeScout to version 1.8.186 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-58163.
In Dolibarr versions up to 23.0.2 a medium severity vulnerability CVE-2026-112361 was detected. This vulnerability allows a remote attacker to bypass Content Security Policy (CSP) restrictions, leading to a complete protection mechanism failure that can facilitate Cross-Site Scripting (XSS) or unauthorized data exfiltration. This occurs due to a flaw within the htdocs/document.php file. By manipulating requests to this endpoint, an attacker can neutralize the intended CSP headers or security boundaries. To address this issue, users should upgrade Dolibarr to version 24.0.0 or later (patch commit 9f9ffa2). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-112361.
In Directus versions prior to 11.13.0 a medium severity vulnerability CVE-2025-64747 was detected. This vulnerability allows an authenticated user with “upload files” and “edit item” permissions to inject malicious JavaScript, leading to Stored Cross-Site Scripting (XSS). This occurs due to a flaw in the Block Editor interface where input is improperly sanitized. An attacker can bypass Content Security Policy (CSP) restrictions by combining file uploads with iframe srcdoc attributes, resulting in persistent script execution whenever other users view the compromised content. To address this issue, users should upgrade Directus to version 11.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64747.
In Directus versions prior to 11.13.0 a medium severity vulnerability CVE-2025-64746 was detected. This vulnerability can unintentionally grant roles unauthorized access to read or modify data. This occurs due to improper permission handling on deleted fields. When a field is removed from a collection, Directus fails to clean up its field-level permissions, leaving the reference in the permissions table intact. If an administrator later creates a new field using the exact same name, this new field automatically inherits the outdated, stale permission entries. This security gap is particularly risky in multi-tenant or production environments where field names might be reused under the assumption that old permissions were fully cleared. To address this issue, users should upgrade Directus to version 11.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64746.
Read more CMS
In Cal.com and Cal.diy versions up to 6.2.0 a medium severity vulnerability CVE-2026-109143 was detected. This vulnerability allows a remote attacker to bypass authorization checks and delete credentials, leading to improper privilege management. This occurs due to a flaw in the credentials.delete function within the /api/trpc/credentials/delete endpoint of the Credentials Handler component. By manipulating the teamId argument, an attacker can perform unauthorized actions on team credentials. Warning: A public exploit for this vulnerability has been disclosed, and the vendor has not yet responded or provided an official patch. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-109143.
In Event Gallery component for Joomla versions 6.5.0 and earlier a medium severity vulnerability CVE-2026-100747 was detected. This vulnerability allows a third-party site to upload files to an event and overwrite existing files. To address this issue, users should upgrade Event Gallery to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-100747.
Read more CMS