In Apache NiFi versions 2.0.0 through 2.10.0 a critical severity vulnerability CVE-2026-68980 was detected. This vulnerability allows unauthorized asset deletion via the REST API. To address this issue, users should upgrade Apache NiFi to version 2.11.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-68980.
Read more Data Analytics
In Apache NiFi versions 1.5.0 through 2.10.0 a high severity vulnerability CVE-2026-68981 was detected. This vulnerability allows attackers to consume excessive amounts of memory through crafted requests. To address this issue, users should upgrade Apache NiFi to version 2.11.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-68981.
Read more Data Analytics
In Exclusive Addons for Elementor component for WordPress versions 2.7.9.8 and earlier a medium severity vulnerability CVE-2026-12231 was detected. This vulnerability allows authenticated attackers to inject arbitrary web scripts. To address this issue, users should upgrade Exclusive Addons for Elementor to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-12231.
Read more CMS
In Bouncy Castle component for Java versions before 1.85 a high severity vulnerability CVE-2026-59639 was detected. This vulnerability allows attackers to bypass signature verification. To address this issue, users should upgrade Bouncy Castle to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-59639.
Read more Application Development
In the Bouncy Castle for Java component versions before 1.85 a high severity vulnerability CVE-2026-59651 was detected. This vulnerability allows an attacker who can supply or tamper with a keystore file to forge a valid MAC over modified contents. To address this issue, users should upgrade the Bouncy Castle for Java library to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-59651.
Read more Application Development
In the Bouncy Castle component for Java versions before 1.85 a high severity vulnerability CVE-2026-59642 was detected. This vulnerability allows an attacker to tamper with message content without invalidating the authentication code. To address this issue, users should upgrade the Bouncy Castle component to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-59642.
Read more Application Development
In the Bouncy Castle component for Java before 1.85 a high severity vulnerability CVE-2026-59646 was detected. This vulnerability allows attackers to cause a denial of service or execute arbitrary code. To address this issue, users should upgrade the Bouncy Castle for Java component to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-59646.
Read more Application Development
In Drupal core versions 7.x and 8.x a critical severity vulnerability CVE-2018-7602 was detected. This vulnerability allows a remote attacker to execute arbitrary code (RCE), potentially resulting in a complete site compromise. This occurs due to flaws within multiple subsystems of Drupal core, and is closely related to the previously disclosed SA-CORE-2018-002 vulnerability. Warning: Public exploits are available, and this vulnerability is actively being exploited in the wild, including in ransomware campaigns. To address this issue, administrators must urgently upgrade Drupal to a patched version [укажите исправленную версию, например, 7.59, 8.4.8, или 8.5.3]. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2018-7602.
Read more Application Development
In Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 a high severity vulnerability CVE-2026-72730 was detected. This vulnerability allows an attacker to execute malicious scripts in the context of a victim’s browser, leading to Stored Cross-Site Scripting (XSS). This occurs because the Rich Text Editor improperly renders chat-transcript usernames as raw HTML without adequate escaping or sanitization. By crafting a username that includes malicious HTML or JavaScript payloads, an attacker can persistently inject code that gets executed whenever other users view the affected chat transcript. To address this issue, users should upgrade Discourse to versions 2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-72730.