Our news and updates

In Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 a high severity vulnerability CVE-2026-72730 was detected. This vulnerability allows an attacker to execute malicious scripts in the context of a victim’s browser, leading to Stored Cross-Site Scripting (XSS). This occurs because the Rich Text Editor improperly renders chat-transcript usernames as raw HTML without adequate escaping or sanitization. By crafting a username that includes malicious HTML or JavaScript payloads, an attacker can persistently inject code that gets executed whenever other users view the affected chat transcript. To address this issue, users should upgrade Discourse to versions 2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-72730.

In Budibase Server versions prior to 3.40.0 a high severity vulnerability CVE-2026-73618 was detected. This vulnerability allows an authenticated attacker with query write permissions to read, modify, or delete arbitrary documents within the database. This occurs because user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. As a result, an attacker can inject JSON structural characters to alter the underlying MongoDB queries and bypass intended filters. To address this issue, users should upgrade Budibase Server to version 3.40.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-73618.

In Baserow versions up to 2.3.2 a medium severity vulnerability CVE-2026-18816 was detected. This vulnerability allows a remote attacker to bypass two-factor authentication (2FA) mechanisms, leading to improper authentication and potential unauthorized account access. This occurs due to a flaw in the verify function within the backend/src/baserow/api/two_factor_auth/views.py file of the 2FA Verify Endpoint. Although the attack complexity is considered high and exploitation is difficult, successful manipulation of this endpoint compromises the authentication process. To address this issue, users should upgrade Baserow to version 2.3.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-18816.

In Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 (with earlier unsupported versions potentially affected) a high severity vulnerability CVE-2026-15307 was detected. This vulnerability allows an attacker to perform arbitrary server-side file writes and Server-Side Request Forgery (SSRF), potentially leading to Remote Code Execution (RCE). This occurs because GeoDjango spatial lookups optimistically parse right-hand-side values as a raster by passing them to the django.contrib.gis.gdal.GDALRaster constructor. If untrusted input reaches this constructor—for example, via a spatial-field filter submitted through the Django admin changelist by a user with view permissions—the system can be exploited. Passing a dictionary or its JSON string representation causes it to be opened in write mode regardless of default settings, allowing the creation of files with attacker-chosen names and contents via a file-backed GDAL driver. Additionally, passing other string values can trigger outbound network requests through GDAL virtual filesystem handlers. To address this issue, users should upgrade Django to versions 5.2.17, 6.0.8, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15307.

In Subscriptions for WooCommerce component for WordPress versions 2.0.0 and earlier a high severity vulnerability CVE-2026-15397 was detected. This vulnerability allows unauthorized users to perform actions. To address this issue, users should upgrade Subscriptions for WooCommerce to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15397.

In PHP versions 8.2.* before 8.2.33, 8.3.* before 8.3.33, 8.4.* before 8.4.24, and 8.5.* before 8.5.9 a critical severity vulnerability CVE-2026-17543 was detected. This vulnerability allows attackers to perform SQL injection attacks. To address this issue, users should upgrade PHP to version 8.2.33 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-17543.

In PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9 a critical severity vulnerability CVE-2026-17544 was detected. This vulnerability allows an attacker to cause an out-of-bounds write with stack and heap corruption. To address this issue, users should upgrade PHP to version 8.4.24 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-17544.

In koku-metrics-operator component for OpenShift in affected versions a high severity vulnerability CVE-2026-18381 was detected. This vulnerability allows a user to specify an arbitrary upload URL. To address this issue, users should upgrade OpenShift to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-18381.

In FuseWP component for WordPress versions 1.1.24.2 and earlier a medium severity vulnerability CVE-2026-5582 was detected. This vulnerability allows attackers to trick authenticated users into performing unintended actions. To address this issue, users should upgrade FuseWP to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-5582.