Our news and updates

In Dolibarr ERP & CRM versions up to and including 22.0.4 a high severity vulnerability CVE-2026-31018 was detected. This vulnerability allows an authenticated user with restricted privileges (limited to HTML/JavaScript editing) to inject and execute arbitrary PHP code, potentially leading to Remote Code Execution (RCE) and privilege escalation. This occurs due to the inconsistent application of PHP code detection and permission enforcement within the Website module. During website page creation, certain input parameters remain unprotected, allowing an attacker to bypass intended restrictions and supply malicious PHP payloads. To address this issue, users should upgrade Dolibarr to a patched version 23.0.0 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-31018.

In Kestra versions prior to 1.3.24 a high severity vulnerability CVE-2026-55069 was detected. This vulnerability allows an attacker who has gained read access to the database to recover the administrator password offline, potentially leading to vertical privilege escalation. This occurs because the BasicAuth authentication component uses the SHA-512 hashing algorithm, which has a high computation speed and lacks the necessary work factors to deter rapid brute-force or dictionary attacks. If the password is successfully cracked in a Kubernetes deployment, the attacker can further compromise the system by reading the cluster ServiceAccount Token and all Kubernetes Secrets. To address this issue, users should upgrade Kestra to version 1.3.24 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-55069.

In Ghost CMS version 4.42.0 a high severity vulnerability CVE-2022-28397 was reported. This vulnerability reportedly allows an attacker to execute arbitrary code (RCE) via a maliciously crafted file uploaded through the file upload module. However, it should be noted that the vendor disputes this vulnerability, stating that according to Ghost’s security documentation, files can only be uploaded and published by strictly trusted users, and this functionality is intentional. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2022-28397.

In Joomla versions before 6.6.2 a critical severity vulnerability CVE-2026-48908 was detected. This vulnerability allows unauthenticated users to upload arbitrary files, resulting in the upload and execution of PHP code. To address this issue, users should upgrade Joomla to version 6.6.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48908.

In Joomla versions 3.2.1 through 3.9.14, versions 4.0.0 through 4.0.7 a critical severity vulnerability CVE-2026-48939 was detected. This vulnerability allows attackers to upload arbitrary files via the iCagenda file attachment feature, enabling PHP code upload and remote code execution. To address this issue, users should upgrade Joomla to version 3.9.15 and 4.0.8 (or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48939.

In WordPress versions 1.21.16 a high severity vulnerability CVE-2020-37255 was detected. This vulnerability allows unauthenticated attackers to obtain valid administrator session cookies and access the WordPress dashboard without credentials. To address this issue, users should upgrade plugin to version beyond 1.2.4.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2020-37255.

In PHP versions 1.2.4.1 a critical severity vulnerability CVE-2019-25763 was detected. This vulnerability allows attackers to bypass authentication by submitting a crafted POST request to admin-ajax.php with the uabb-lf-google-submit action to obtain session cookies and authenticate as an administrator. To address this issue, users should upgrade PHP to version 1.2.4.1 (ideally 1.2.5 or higher). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2019-25763.

In Helm versions 4.0.0 to before 4.1.4 a high severity vulnerability CVE-2026-35205 was detected. This vulnerability allows an attacker to bypass plugin signature verification, potentially leading to the installation of untrusted or malicious code. This occurs because the Helm plugin verification mechanism “fails open” when a provenance (.prov) file is missing, even if signature verification is explicitly required by the user’s configuration. By deliberately omitting the .prov file, a malicious actor can force Helm to successfully install an unsigned plugin without raising a security error. To address this issue, users should upgrade Helm to version 4.1.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-35205.

In Elasticsearch versions up to 8.19.16/9.3.5/9.4.2 a medium severity vulnerability CVE-2026-56149 was detected. This vulnerability allows an authenticated user with elevated privileges to cause a Denial of Service (DoS) by rendering the affected node unavailable. This occurs due to an Allocation of Resources Without Limits or Throttling (CWE-770) flaw in the processing of machine learning requests. By submitting a specially crafted machine learning request, an attacker can trigger excessive memory allocation (CAPEC-130), leading to resource exhaustion and the subsequent unavailability of the Elasticsearch node. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56149.