Our news and updates

In GitLab CE/EE versions from 15.10 before 18.3.6, 18.4 before 18.4.4 and 18.5 before 18.5.2 a high severity vulnerability CVE-2025-11224 was detected. This vulnerability allows an authenticated attacker to perform stored cross-site scripting attacks due to improper input validation in the Kubernetes proxy functionality, potentially executing malicious scripts in the context of other users’ browsers. To address this issue, users should upgrade GitLab to versions 18.3.6, 18.4.4, 18.5.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-11224.

In Nexus Repository 3 versions 3.82.0 through 3.87.1 a medium severity vulnerability CVE-2026-0601 was detected. This vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in a victim’s browser via a specially crafted request that requires user interaction, leading to reflected cross-site scripting attacks. To address this issue, users should upgrade Nexus Repository 3 to version 3.88.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-0601.

In OpenProject versions prior to 16.6.4 a critical severity vulnerability CVE-2026-22600 was detected. This vulnerability allows authenticated attackers with permission to upload attachments to exploit the work package PDF export functionality to read arbitrary local files by uploading a specially crafted SVG file disguised as a PNG, which abuses ImageMagick image processing during PDF generation. To address this issue, users should upgrade OpenProject to version 16.6.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22600.

In OpenProject versions 16.6.1 and below a high severity vulnerability CVE-2026-22601 was detected. This vulnerability allows a registered administrator to execute arbitrary commands by configuring the sendmail binary path and sending a test email. To address this issue, users should upgrade OpenProject to version 16.6.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22601.

In OpenProject versions 16.6.1 and below a low severity vulnerability CVE-2026-22602 was detected. This vulnerability allows a low‑privileged logged-in user to enumerate and view the full names of other users due to predictable sequential user IDs, both via the web interface and the API. To address this issue, users should upgrade OpenProject to version 16.6.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22602.

In Kibana versions 7.x, from 8.0.0 up to and including 8.19.9, from 9.0.0 up to and including 9.1.9, 9.2.0 up to and including 9.2.3 a high severity vulnerability CVE-2026-0543 was detected. This vulnerability allows authenticated attackers with sufficient view-level privileges to trigger excessive memory allocation by supplying a specially crafted email address parameter to the Email Connector, resulting in a denial of service and complete service unavailability until a manual restart is performed. To address this issue, users should upgrade Kibana to versions 8.19.10, 9.1.10 or 9.2.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-0543.

In Kibana versions from 8.15.0 up to and including 8.19.9, from 9.0.0 up to and including 9.1.9, 9.2.0 up to and including 9.2.3 a high severity vulnerability CVE-2026-0532 was detected. This vulnerability allows authenticated attackers with privileges to create or modify connectors to trigger server-side request forgery and arbitrary file disclosure by supplying a specially crafted credentials JSON payload in the Google Gemini connector configuration, leading to unauthorized network requests and file reads due to insufficient input validation. To address this issue, users should upgrade Kibana to versions 8.19.10, 9.1.10 or 9.2.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-0532.

In Kibana Fleet versions from 7.10.0 up to and including 7.17.29, from 8.0.0 up to and including 8.19.9, from 9.0.0 up to and including 9.1.9 and from 9.2.0 up to and including 9.2.3 a medium severity vulnerability CVE-2026-0531 was detected. This vulnerability allows authenticated attackers with low-level (viewer-equivalent) privileges to trigger excessive memory consumption by sending a specially crafted bulk retrieval request, causing redundant database operations that can crash the server and result in denial of service for all users. To address this issue, users should upgrade Kibana to versions 8.19.10, 9.1.10 or 9.2.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-0531.

In Kibana Fleet versions from 7.10.0 up to and including 7.17.29, 8.0.0 up to and including 8.19.9, from 9.0.0 up to and including 9.1.9 and from 9.2.0 up to and including 9.2.3 a medium severity vulnerability CVE-2026-0530 was detected. This vulnerability allows attackers to trigger excessive resource consumption by sending a specially crafted request that causes redundant processing operations, eventually leading to service degradation or complete unavailability. To address this issue, users should upgrade Kibana to versions 8.19.10, 9.1.10 or 9.2.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-0530.