Infrastructure and Network

In authentik versions prior to 2025.10.4 and 2025.12.4 a high severity vulnerability CVE-2026-25748 was identified. This vulnerability allows an attacker to bypass authentication by using a malformed cookie when forward authentication is enabled in the authentik Proxy Provider, particularly when used with Traefik or Caddy as a reverse proxy. Exploiting this issue prevents the setting of authentik-specific X-Authentik-* headers, potentially granting unauthorized access. To address this issue, users should upgrade authentik to versions 2025.10.4, 2025.12.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25748.

In OpenVPN versions 2.7_alpha1 through 2.7_rc5 a low severity vulnerability CVE-2025-15497 was detected. This vulnerability allows remote authenticated users to trigger an assertion failure due to insufficient epoch key slot processing, resulting in a denial of service. To address this issue, users should upgrade OpenVPN to version 2.7_rc5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-15497.

In the JavaScript Notifier plugin for WordPress versions up to and including 1.2.8 a medium severity vulnerability CVE-2026-1191 was detected. This vulnerability allows authenticated attackers with administrator-level access to inject arbitrary web scripts via plugin settings, which are rendered through the wp_footer action, due to insufficient input sanitization and output escaping of user-supplied attributes. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1191.

In the Meta-box GalleryMeta plugin for WordPress versions up to and including 3.0.1 a medium severity vulnerability CVE-2026-1302 was detected. This vulnerability allows authenticated attackers with editor-level permissions or higher to inject arbitrary malicious scripts via the admin settings, leading to stored cross-site scripting (XSS) that executes whenever a user accesses the affected pages. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1302.

In the Responsive Header plugin for WordPress versions up to and including 1.0 a medium severity vulnerability CVE-2026-1300 was detected. This vulnerability allows authenticated attackers with administrator-level access or higher to inject arbitrary web scripts via multiple plugin settings parameters, which are stored and executed when users access affected pages, due to insufficient input sanitization and output escaping. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1300.

In the Postalicious plugin for WordPress versions up to and including 3.0.1 a medium severity vulnerability CVE-2026-1266 was detected. This vulnerability allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts via admin settings, which are stored and executed when users access affected pages, due to insufficient input sanitization and output escaping. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1266.

In the Administrative Shortcodes plugin for WordPress versions up to, and including, 0.3.4 a high severity vulnerability CVE-2026-1257 was detected. This vulnerability allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary files on the server via the slug attribute of the get_template shortcode, due to insufficient path validation of user-supplied input passed to the get_template_part() function. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1257.

In the LeadBI plugin for WordPress versions up to and including 1.7 a medium severity vulnerability CVE-2026-1189 was detected. This vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the form_id parameter of the leadbi_form shortcode, due to insufficient input sanitization and output escaping of user-supplied attributes. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1189.

In Traefik versions prior to 2.11.35 and 3.6.7 a medium severity vulnerability CVE-2026-22045 was detected. This vulnerability allows unauthenticated attackers to cause a denial of service by opening multiple ACME TLS-ALPN connections and stalling the handshake, indefinitely tying up goroutines and file descriptors when automatic certificate generation is enabled. To address this issue, users should upgrade Traefik to version 2.11.35 or 3.6.7. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22045.