Our news and updates

In Baserow version 2.3.3 a high severity vulnerability CVE-2026-19754 was detected. This vulnerability allows a low-privileged authenticated user to execute arbitrary database queries, leading to SQL Injection (SQLi) and potential privilege escalation. This occurs due to improper input validation in the index() formula function. A user with permissions to create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. When Baserow recalculates the formula field values, the injected payload is executed. Because the generated SQL runs through the application’s database connection, it executes with the full privileges of the Baserow PostgreSQL role rather than the restricted permissions of the authenticated user. To address this issue, users should upgrade Baserow to a patched version 2.3.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19754.

In GitLab CE/EE versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 a critical severity vulnerability CVE-2026-19478 was detected. This vulnerability allows an unauthenticated remote attacker to modify or delete public projects and user data, leading to severe data integrity compromise and potential data loss. This occurs due to an Improper Control of Generation of Code (Code Injection) flaw. Under certain conditions, an attacker can supply malicious input via a GraphQL directive that is improperly validated, tricking the application into executing unauthorized operations. To address this issue, users should upgrade GitLab CE/EE to versions 18.11.11, 19.0.8, 19.1.6, 19.2.4, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19478.

In Elasticsearch versions from 8.18.0 before 8.19.20, and from 9.0.0 before 9.4.5 a medium severity vulnerability CVE-2026-78605 was detected. This vulnerability allows a network attacker to obtain confidential HTTP responses intended for other authenticated users, leading to unauthorized information disclosure. This occurs due to an Inconsistent Interpretation of HTTP Requests, commonly known as HTTP Request Smuggling (CWE-444). Under specific proxy deployment configurations, an attacker can manipulate HTTP requests to desynchronize the connection between the frontend proxy and the backend Elasticsearch server, allowing them to intercept or view responses belonging to other users’ sessions (CAPEC-33). To address this issue, users should upgrade Elasticsearch to versions 8.19.20, 9.4.5, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-78605.

In Dolibarr versions up to 21.0.4, 22.0.5, and 23.0.3 a medium severity vulnerability CVE-2026-85401 was detected. This vulnerability allows a remote attacker to bypass access restrictions, potentially leading to unauthorized access, modification, or disclosure of sensitive files. This occurs due to an improper access control flaw within the htdocs/core/filemanagerdol/connectors/php/config.inc.php file of the Legacy File Manager component. Warning: A public exploit for this vulnerability is available and could be used in active attacks. To address this issue, users should upgrade Dolibarr to version 23.0.4 or later, or apply the official patch (commit ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-85401.

In iCagenda component for Joomla versions 4.0.8 to 4.0.12 a high severity vulnerability CVE-2026-75948 was detected. This vulnerability allows an authenticated attacker to inject malicious scripts. To address this issue, users should upgrade iCagenda to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-75948.

In Phoca Cart component for Joomla versions 5.0.0 through 6.1.7 a medium severity vulnerability CVE-2026-76565 was detected. This vulnerability allows attackers to execute arbitrary web scripts. To address this issue, users should upgrade Phoca Cart to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-76565.

In Zoo component for Joomla versions before 4.1.65 a medium severity vulnerability CVE-2026-76610 was detected. This vulnerability allows unauthenticated users to modify tags. To address this issue, users should upgrade Zoo to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-76610.

In Phoca Cart component for Joomla versions 6.1.7 and earlier a high severity vulnerability CVE-2026-76564 was detected. This vulnerability allows attackers to execute arbitrary web scripts. To address this issue, users should upgrade Phoca Cart to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-76564.

In Phoca Download component for Joomla versions 5.0.0 through 6.1.4 a medium severity vulnerability CVE-2026-76569 was detected. This vulnerability allows attackers to execute arbitrary web scripts. To address this issue, users should upgrade Phoca Download to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-76569.