Our news and updates

In Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 a high severity vulnerability CVE-2026-91156 was detected. This vulnerability allows an authenticated user to receive live and recent chat messages from a read-restricted category, leading to unauthorized information disclosure. This occurs due to a flaw in the MessageBus audience calculation. The publication path bounded events solely by category visibility without enforcing the site’s group restrictions for Chat eligibility. Consequently, users who were permitted to view the category but explicitly denied access to Chat could still intercept live message content exposed in the MessageBus backlog. Note that this issue does not permit retrieval of the channel’s full history through the Chat API, nor does it allow message creation or modification. To address this issue, users should upgrade Discourse to versions 2026.9.0, 2026.8.1, 2026.7.3, 2026.1.9, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-91156.

In Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 a high severity vulnerability CVE-2026-91157 was detected. This vulnerability allows anonymous users to access restricted media and attachments, leading to unauthorized information disclosure. This occurs because sites with secure uploads enabled fail to reconcile existing upload security metadata when a previously public category becomes read-restricted, or when category permissions are modified during a bulk import. As a result, media and attachments uploaded while the category was public retain a public accessibility flag. These files remain reachable by anonymous users through their short upload URLs, even if the associated topics have been deleted. To address this issue, users should upgrade Discourse to versions 2026.9.0, 2026.8.1, 2026.7.3, 2026.1.9, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-91157.

In CryptPad versions from 2025.3.1 before 2026.2.2 a high severity vulnerability CVE-2025-51846 was detected. This vulnerability allows a remote, unauthenticated attacker to significantly degrade or completely deny service for all users of a CryptPad instance, leading to a Denial of Service (DoS). This occurs due to an unbounded WebSocket frame flood flaw, where the server fails to properly limit or throttle the rate and volume of incoming WebSocket frames. By sending a continuous, massive number of frames, an attacker can overwhelm the server’s resources and disrupt application availability. To address this issue, users should upgrade CryptPad to version 2026.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-51846.

In Cal.com and Cal.diy versions up to 6.2.0 a medium severity vulnerability CVE-2026-109143 was detected. This vulnerability allows a remote attacker to bypass authorization checks and delete credentials, leading to improper privilege management. This occurs due to a flaw in the credentials.delete function within the /api/trpc/credentials/delete endpoint of the Credentials Handler component. By manipulating the teamId argument, an attacker can perform unauthorized actions on team credentials. Warning: A public exploit for this vulnerability has been disclosed, and the vendor has not yet responded or provided an official patch. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-109143.

In Elasticsearch versions from 9.2.0 before 9.4.8, and from 9.5.0 before 9.5.5 a medium severity vulnerability CVE-2026-102409 was detected. This vulnerability allows an authenticated user with low privileges to terminate an Elasticsearch node, resulting in a Denial of Service (DoS). This occurs due to an Uncontrolled Recursion (CWE-674) flaw that leads to excessive resource allocation (CAPEC-130). By triggering this recursive behavior, an attacker can exhaust system resources and crash the targeted node, disrupting overall service availability. To address this issue, users should upgrade Elasticsearch to versions 9.4.8, 9.5.5, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-102409.

In Drupal core versions from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, and from 11.2.0 before 11.2.8 a medium severity vulnerability CVE-2025-13080 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) condition via forceful browsing. This occurs due to an Improper Check for Unusual or Exceptional Conditions flaw within the application. An attacker can exploit this weakness by forcibly navigating to specific paths or triggering unexpected application states, which the system fails to handle properly, ultimately leading to service disruption. To address this issue, users should upgrade Drupal core to versions 10.4.9, 10.5.6, 11.1.9, 11.2.8, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13080.

In Appwrite versions up to 2.3.0 a medium severity vulnerability CVE-2026-108770 was detected. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) attacks, potentially gaining unauthorized access to internal network resources or services. This occurs due to a flaw in the PublicHostname function within the src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php file of the Browser Screenshot Service component. By manipulating the url argument, an attacker can trick the server into making unintended outbound HTTP requests on their behalf. To address this issue, users should upgrade Appwrite to version 2.4.0 or later, or apply the official patch (commit 393255e7302ae5503331d45802e2eee01c6a47fe). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-108770.

In Argo CD versions from 2.10.0 prior to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 a critical severity vulnerability CVE-2026-77459 was detected. This vulnerability allows an attacker with write access to an Application’s Git repository to bypass destination and resource authorization checks, potentially creating unauthorized resources within the Kubernetes cluster. This occurs because Argo CD creates PostDelete resource hooks without applying the standard AppProject allow/deny lists used during normal synchronization. By committing a maliciously crafted delete hook targeting a forbidden namespace, server, group, or kind, the attacker can force the application-controller to create that resource using its destination-cluster credentials when the Application is deleted. While the impact is bounded by the controller’s own access rights, it can lead to the compromise of cluster-scoped resources and disallowed namespaces. To address this issue, users should upgrade Argo CD to versions 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-77459.

In Django versions from 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7 a low severity vulnerability CVE-2025-59682 was detected. This vulnerability allows for partial directory traversal, potentially leading to unauthorized file writes outside the intended target directory. This occurs due to a flaw in the django.utils.archive.extract() function, which is utilized when developers run the startapp --template and startproject --template management commands. If a developer uses a maliciously crafted archive where file paths share a common prefix with the target directory, the extraction process can escape the intended extraction path. To address this issue, users should upgrade Django to versions 4.2.25, 5.1.13, 5.2.7, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-59682.