Our news and updates

In Wallet System for WooCommerce component for WooCommerce versions before 2.7.10 a medium severity vulnerability CVE-2026-15045 was detected. This vulnerability allows authenticated customers to arbitrarily reduce their own order total without paying the merchant. To address this issue, users should upgrade Wallet System for WooCommerce to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15045.

In Fabrik component for Joomla versions before 4.6.8 a critical severity vulnerability CVE-2026-67282 was detected. This vulnerability allows an unauthenticated attacker to execute arbitrary code. To address this issue, users should upgrade Fabrik to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-67282.

In SQLite in affected versions a medium severity vulnerability CVE-2025-41771 was detected. This vulnerability allows an authenticated attacker to perform a SQL injection. To address this issue, users should upgrade SQLite to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-41771.

In OpenShift in affected versions a high severity vulnerability CVE-2026-50236 was detected. This vulnerability allows authenticated attackers to perform Server-Side Request Forgery (SSRF) attacks. To address this issue, users should upgrade OpenShift to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50236.

In Kibana versions up to 8.16.2.a medium severity vulnerability CVE-2026-78581 was detected. This vulnerability allows an authenticated attacker to access or modify AI Assistant conversations they do not own, leading to unauthorized data modification and potential information disclosure. This occurs due to an Authorization Bypass Through User-Controlled Key (CWE-639) flaw. By referencing another user’s AI Assistant conversation identifier, an attacker can bypass Access Control Lists (ACLs) and interact with that conversation (CAPEC-1). However, successful exploitation requires the attacker to obtain or guess this specific, hard-to-guess identifier. To address this issue, users should upgrade Kibana to a patched version Elastic Kibana versions 8.16.3 and 8.17.2.. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-78581.

In GitLab EE versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 a high severity vulnerability CVE-2026-19228 was detected. This vulnerability allows an authenticated user to cause their AI usage to be attributed to another namespace. This occurs due to an Authorization Bypass Through User-Controlled Key flaw, where identity information supplied in requests is improperly authorized. By manipulating this information under certain conditions, an attacker can bypass intended access controls and shift AI usage accounting to a different tenant or namespace. To address this issue, users should upgrade GitLab EE to versions 19.1.4, 19.2.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19228.

In FreeIPA versions before 4.13.3 a high severity vulnerability CVE-2026-73197 was detected. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by exhausting system memory and disrupting service availability. This occurs due to an unbounded request body read flaw in the /ipa/migration/migration.py endpoint. When processing form POST requests, the migration handler reads the entire, attacker-controlled request body directly into memory without enforcing size limits. By sending oversized requests, an attacker can force excessive memory consumption and severely slow down request handling. There’s no fix available for this issue at the moment. . For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-73197.

In OpenShift versions prior to the latest patch a high severity vulnerability CVE-2026-50236 was detected. This vulnerability allows authenticated attackers to make arbitrary network requests from the server’s privileged network position. To address this issue, users should upgrade OpenShift to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50236.

In previous versions of OpenShift a high severity vulnerability CVE-2026-50236 was detected. This vulnerability allows an authenticated attacker to target arbitrary endpoints from a privileged network position. To address this issue, users should upgrade OpenShift to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50236.