Our news and updates

In Exclusive Addons for Elementor component for WordPress versions 2.7.9.8 and earlier a medium severity vulnerability CVE-2026-12231 was detected. This vulnerability allows authenticated attackers to inject arbitrary web scripts. To address this issue, users should upgrade Exclusive Addons for Elementor to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-12231.

In Bouncy Castle component for Java versions before 1.85 a high severity vulnerability CVE-2026-59639 was detected. This vulnerability allows attackers to bypass signature verification. To address this issue, users should upgrade Bouncy Castle to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-59639.

In Drupal core versions 7.x and 8.x a critical severity vulnerability CVE-2018-7602 was detected. This vulnerability allows a remote attacker to execute arbitrary code (RCE), potentially resulting in a complete site compromise. This occurs due to flaws within multiple subsystems of Drupal core, and is closely related to the previously disclosed SA-CORE-2018-002 vulnerability. Warning: Public exploits are available, and this vulnerability is actively being exploited in the wild, including in ransomware campaigns. To address this issue, administrators must urgently upgrade Drupal to a patched version [укажите исправленную версию, например, 7.59, 8.4.8, или 8.5.3]. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2018-7602.

In Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 a high severity vulnerability CVE-2026-72730 was detected. This vulnerability allows an attacker to execute malicious scripts in the context of a victim’s browser, leading to Stored Cross-Site Scripting (XSS). This occurs because the Rich Text Editor improperly renders chat-transcript usernames as raw HTML without adequate escaping or sanitization. By crafting a username that includes malicious HTML or JavaScript payloads, an attacker can persistently inject code that gets executed whenever other users view the affected chat transcript. To address this issue, users should upgrade Discourse to versions 2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-72730.

In Budibase Server versions prior to 3.40.0 a high severity vulnerability CVE-2026-73618 was detected. This vulnerability allows an authenticated attacker with query write permissions to read, modify, or delete arbitrary documents within the database. This occurs because user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. As a result, an attacker can inject JSON structural characters to alter the underlying MongoDB queries and bypass intended filters. To address this issue, users should upgrade Budibase Server to version 3.40.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-73618.

In Baserow versions up to 2.3.2 a medium severity vulnerability CVE-2026-18816 was detected. This vulnerability allows a remote attacker to bypass two-factor authentication (2FA) mechanisms, leading to improper authentication and potential unauthorized account access. This occurs due to a flaw in the verify function within the backend/src/baserow/api/two_factor_auth/views.py file of the 2FA Verify Endpoint. Although the attack complexity is considered high and exploitation is difficult, successful manipulation of this endpoint compromises the authentication process. To address this issue, users should upgrade Baserow to version 2.3.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-18816.

In Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 (with earlier unsupported versions potentially affected) a high severity vulnerability CVE-2026-15307 was detected. This vulnerability allows an attacker to perform arbitrary server-side file writes and Server-Side Request Forgery (SSRF), potentially leading to Remote Code Execution (RCE). This occurs because GeoDjango spatial lookups optimistically parse right-hand-side values as a raster by passing them to the django.contrib.gis.gdal.GDALRaster constructor. If untrusted input reaches this constructor—for example, via a spatial-field filter submitted through the Django admin changelist by a user with view permissions—the system can be exploited. Passing a dictionary or its JSON string representation causes it to be opened in write mode regardless of default settings, allowing the creation of files with attacker-chosen names and contents via a file-backed GDAL driver. Additionally, passing other string values can trigger outbound network requests through GDAL virtual filesystem handlers. To address this issue, users should upgrade Django to versions 5.2.17, 6.0.8, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15307.

In Subscriptions for WooCommerce component for WordPress versions 2.0.0 and earlier a high severity vulnerability CVE-2026-15397 was detected. This vulnerability allows unauthorized users to perform actions. To address this issue, users should upgrade Subscriptions for WooCommerce to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15397.

In PHP versions 8.2.* before 8.2.33, 8.3.* before 8.3.33, 8.4.* before 8.4.24, and 8.5.* before 8.5.9 a critical severity vulnerability CVE-2026-17543 was detected. This vulnerability allows attackers to perform SQL injection attacks. To address this issue, users should upgrade PHP to version 8.2.33 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-17543.