Our news and updates

In Apache ActiveMQ versions before 5.19.9, a high severity vulnerability CVE-2026-59878 was detected. This vulnerability allows a remote unauthenticated attacker to cause a denial-of-service. To address this issue, users should upgrade Apache ActiveMQ to version 5.19.9 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-59878.

In Phoca Commander component for Joomla versions 6.1.1 and earlier a medium severity vulnerability CVE-2026-65764 was detected. This vulnerability allows attackers to execute arbitrary scripts in the user’s browser. To address this issue, users should upgrade Phoca Commander to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-65764.

In Phoca Commander component for Joomla versions 6.1.1 and earlier a medium severity vulnerability CVE-2026-65765 was detected. This vulnerability allows attackers to access unauthorized files on the server. To address this issue, users should upgrade Phoca Commander to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-65765.

In the SP Page Builder component for Joomla versions before 6.7.1 a critical severity vulnerability CVE-2026-65766 was detected. This vulnerability allows attackers to perform an SQL injection. To address this issue, users should upgrade SP Page Builder to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-65766.

In SP Page Builder component for Joomla versions prior to 6.7.1 a high severity vulnerability CVE-2026-65877 was detected. This vulnerability allows an authenticated attacker to execute arbitrary SQL commands on the database. To address this issue, users should upgrade SP Page Builder to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-65877.

In Directus versions prior to 12.1.0 a high severity vulnerability CVE-2026-10716 was detected. This vulnerability allows an authenticated administrator to execute arbitrary SQL commands, potentially leading to unauthorized data extraction via time-based blind SQL Injection (SQLi). This occurs during the collection creation flow when the instance uses PostgreSQL with the PostGIS extension enabled. By supplying a malicious fields[].type value that starts with geometry but is followed by attacker-controlled SQL syntax, an attacker can bypass input validation and manipulate the underlying database queries. To address this issue, users should upgrade Directus to version 12.1.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-10716.

In MongoDB versions prior to 7.0.39 a medium severity vulnerability CVE-2026-13066 was detected. This vulnerability allows for the disclosure of internal process memory contents. To address this issue, users should upgrade MongoDB to version 7.0.39 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-13066.

In Cal.com OSS a critical severity vulnerability CVE-2026-16624 was detected. This vulnerability allows any authenticated user to steal sensitive booking data, including attendee PII and video-call passwords, from any team. To address this issue, users should upgrade Cal to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-16624.

In the Kubernetes Java client library component for Kubernetes in unspecified versions a unknown severity vulnerability CVE-2026-15687 was detected. This vulnerability allows a compromised pod to create new files in arbitrary locations on the client machine. To address this issue, users should upgrade the Kubernetes Java client library to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15687.