Our news and updates

In Joomla! Core versions 3.9.0 up to and including 5.4.5 and 6.0.0 up to and including 6.1.0 a critical severity vulnerability CVE-2026-48902 was detected. This vulnerability may allow network attackers to intercept sensitive account recovery tokens. This occurs because the password and username reset features improperly generate plain HTTP links, even for HTTPS connections, if the “Force SSL” configuration flag is not explicitly enabled. As a result, the reset links are transmitted without transport encryption, potentially leading to unauthorized account access. To address this issue, users should upgrade Joomla! Core to version 5.4.6 or 6.1.1 (or later) or explicitly enable the “Force SSL” setting. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48902.

In Milvus versions up to 2.6.13 a medium severity vulnerability CVE-2026-10814 was detected. This vulnerability may allow a local attacker to compromise the system through the exploitation of a weak cryptographic hash. This occurs because the Grantee ID Hash Handler component (specifically in internal/metastore/kv/rootcoord/kv_catalog.go) utilizes a weak hashing algorithm, which an attacker could potentially manipulate, despite the attack complexity being high. To address this issue, users should apply the recommended patch (commit 3d932f1c3e065351c4440c27abe1e6479752544d). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-10814.

In MLflow versions up to 3.10.0 a low severity vulnerability CVE-2026-10803 was detected. This vulnerability may allow a local attacker to compromise dataset integrity or cause hash collisions. This occurs because the Dataset Digest Computation component (specifically the mlflow.data.digest_utils function in mlflow/data/digest_utils.py) utilizes a weak cryptographic hashing algorithm. Although the attack complexity is rated as high and exploitability is difficult, a proof of concept has been published. There is no fix to this yet. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-10803.

In Zabbix versions prior to 6.0.41, 7.0.18, and 7.4.2 a high severity vulnerability CVE-2026-23925 was detected. This vulnerability allows an authenticated low-privileged user to create unauthorized hosts, potentially leading to a loss of confidentiality. This occurs because a user with the basic “User” role and template/host write permissions can bypass standard role restrictions by utilizing the configuration.import API to create objects, an action that should normally be restricted for this role. To address this issue, users should upgrade Zabbix to version 7.4.2 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-23925.

In OneDev versions up to 15.0.5 a medium severity vulnerability CVE-2026-11438 was detected. This vulnerability allows a remote attacker to bypass intended access controls. This occurs due to improper authorization validation when manipulating the project.forkedFromId argument within the /projects functionality. To address this issue, users should upgrade OneDev to version 15.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11438.

In Django versions 6.0 before 6.0.6 and 5.2 before 5.2.15 a low severity vulnerability CVE-2026-7666 was detected. This vulnerability allows an on-path network attacker to intercept and read email content in cleartext. This occurs because the django.core.mail.backends.smtp.EmailBackend fails to prevent the reuse of a partially-initialized connection after a failed STARTTLS handshake when the fail_silently parameter is set to True. To address this issue, users should upgrade Django to versions 6.0.6 or 5.2.15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7666.

In Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 a medium severity vulnerability CVE-2026-32244 was detected. This vulnerability allows anonymous and unprivileged users to view removed content, leading to information disclosure. This occurs because the platform caches outdated AI-generated summaries which are not adequately purged when the original content is deleted. Consequently, users who lack the permissions to regenerate summaries can still access the leaked information through the stale cache. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. As a temporary workaround, administrators can restrict summary generation by tightening the allowed groups on the summarization Personas. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-32244.

In MLflow versions up to 3.10.1.dev0 a critical severity vulnerability CVE-2026-2651 was detected. This vulnerability allows an attacker to overwrite artifacts belonging to other users, potentially leading to model supply chain poisoning and arbitrary code execution when compromised models are loaded. This occurs because the authorization logic fails to enforce resource-level permission checks for multipart upload (MPU) endpoints (/mlflow-artifacts/mpu/*) when the –serve-artifacts mode is enabled, enabling unauthorized cross-user writes. To address this issue, users should upgrade MLflow to version 3.10.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-2651.

In authentik versions prior to 2025.12.6, 2026.2.4, and 2026.5.1 a high severity vulnerability CVE-2026-49443 was detected. This vulnerability allows an attacker to log into any user’s account (Account Takeover). This occurs because an attacker who has the ability to change a source connection and possesses an account in one of the configured sources can exploit improper validation of the source connection to bypass authentication. To address this issue, users should upgrade authentik to versions 2025.12.6, 2026.2.4, or 2026.5.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-4944.