Our news and updates

In Page Builder CK component for Joomla versions 3.6.5 and earlier a critical severity vulnerability CVE-2026-77994 was detected. This vulnerability allows an attacker to execute arbitrary SQL commands. To address this issue, users should upgrade Page Builder CK to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-77994.

In Notification Master component for WordPress versions 1.7.1 and earlier a high severity vulnerability CVE-2026-28153 was detected. This vulnerability allows unauthenticated attackers to bypass access controls. To address this issue, users should upgrade Notification Master to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-28153.

In GitLab CE/EE versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 a critical severity vulnerability CVE-2026-19478 was detected. This vulnerability allows an unauthenticated remote attacker to modify or delete public projects and user data, leading to severe data integrity compromise and potential data loss. This occurs due to an Improper Control of Generation of Code (Code Injection) flaw. Under certain conditions, an attacker can supply malicious input via a GraphQL directive that is improperly validated, tricking the application into executing unauthorized operations. To address this issue, users should upgrade GitLab CE/EE to versions 18.11.11, 19.0.8, 19.1.6, 19.2.4, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19478.

In Elasticsearch versions from 8.18.0 before 8.19.20, and from 9.0.0 before 9.4.5 a medium severity vulnerability CVE-2026-78605 was detected. This vulnerability allows a network attacker to obtain confidential HTTP responses intended for other authenticated users, leading to unauthorized information disclosure. This occurs due to an Inconsistent Interpretation of HTTP Requests, commonly known as HTTP Request Smuggling (CWE-444). Under specific proxy deployment configurations, an attacker can manipulate HTTP requests to desynchronize the connection between the frontend proxy and the backend Elasticsearch server, allowing them to intercept or view responses belonging to other users’ sessions (CAPEC-33). To address this issue, users should upgrade Elasticsearch to versions 8.19.20, 9.4.5, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-78605.

In Dolibarr versions up to 21.0.4, 22.0.5, and 23.0.3 a medium severity vulnerability CVE-2026-85401 was detected. This vulnerability allows a remote attacker to bypass access restrictions, potentially leading to unauthorized access, modification, or disclosure of sensitive files. This occurs due to an improper access control flaw within the htdocs/core/filemanagerdol/connectors/php/config.inc.php file of the Legacy File Manager component. Warning: A public exploit for this vulnerability is available and could be used in active attacks. To address this issue, users should upgrade Dolibarr to version 23.0.4 or later, or apply the official patch (commit ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-85401.

In BookStack versions prior to 26.05.4 a high severity vulnerability CVE-2026-82450 was detected. This vulnerability allows an authenticated user with “Import Content” and “Create Books” permissions to execute arbitrary code on the server, leading to Remote Code Execution (RCE). This occurs due to inadequate file validation within the portable ZIP import functionality. An attacker can bypass image extension validation by embedding a PHP polyglot file with a .php filename disguised as a book cover inside the ZIP archive. Because these files are subsequently stored in the public web root, the uploaded malicious script can be triggered and executed via unauthenticated web requests. To address this issue, users should upgrade BookStack to version 26.05.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-82450.

In Baserow version 2.3.3 a high severity vulnerability CVE-2026-19754 was detected. This vulnerability allows a low-privileged authenticated user to execute arbitrary database queries, leading to SQL Injection (SQLi) and potential privilege escalation. This occurs due to improper input validation in the index() formula function. A user with permissions to create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. When Baserow recalculates the formula field values, the injected payload is executed. Because the generated SQL runs through the application’s database connection, it executes with the full privileges of the Baserow PostgreSQL role rather than the restricted permissions of the authenticated user. To address this issue, users should upgrade Baserow to a patched version 2.3.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19754.

In iCagenda component for Joomla versions 4.0.8 to 4.0.12 a high severity vulnerability CVE-2026-75948 was detected. This vulnerability allows an authenticated attacker to inject malicious scripts. To address this issue, users should upgrade iCagenda to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-75948.

In Phoca Cart component for Joomla versions 5.0.0 through 6.1.7 a medium severity vulnerability CVE-2026-76565 was detected. This vulnerability allows attackers to execute arbitrary web scripts. To address this issue, users should upgrade Phoca Cart to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-76565.