Our news and updates

In Budibase Server versions prior to 3.40.0 a high severity vulnerability CVE-2026-73618 was detected. This vulnerability allows an authenticated attacker with query write permissions to read, modify, or delete arbitrary documents within the database. This occurs because user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. As a result, an attacker can inject JSON structural characters to alter the underlying MongoDB queries and bypass intended filters. To address this issue, users should upgrade Budibase Server to version 3.40.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-73618.

In Baserow versions up to 2.3.2 a medium severity vulnerability CVE-2026-18816 was detected. This vulnerability allows a remote attacker to bypass two-factor authentication (2FA) mechanisms, leading to improper authentication and potential unauthorized account access. This occurs due to a flaw in the verify function within the backend/src/baserow/api/two_factor_auth/views.py file of the 2FA Verify Endpoint. Although the attack complexity is considered high and exploitation is difficult, successful manipulation of this endpoint compromises the authentication process. To address this issue, users should upgrade Baserow to version 2.3.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-18816.

In Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 (with earlier unsupported versions potentially affected) a high severity vulnerability CVE-2026-15307 was detected. This vulnerability allows an attacker to perform arbitrary server-side file writes and Server-Side Request Forgery (SSRF), potentially leading to Remote Code Execution (RCE). This occurs because GeoDjango spatial lookups optimistically parse right-hand-side values as a raster by passing them to the django.contrib.gis.gdal.GDALRaster constructor. If untrusted input reaches this constructor—for example, via a spatial-field filter submitted through the Django admin changelist by a user with view permissions—the system can be exploited. Passing a dictionary or its JSON string representation causes it to be opened in write mode regardless of default settings, allowing the creation of files with attacker-chosen names and contents via a file-backed GDAL driver. Additionally, passing other string values can trigger outbound network requests through GDAL virtual filesystem handlers. To address this issue, users should upgrade Django to versions 5.2.17, 6.0.8, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15307.

In Subscriptions for WooCommerce component for WordPress versions 2.0.0 and earlier a high severity vulnerability CVE-2026-15397 was detected. This vulnerability allows unauthorized users to perform actions. To address this issue, users should upgrade Subscriptions for WooCommerce to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15397.

In PHP versions 8.2.* before 8.2.33, 8.3.* before 8.3.33, 8.4.* before 8.4.24, and 8.5.* before 8.5.9 a critical severity vulnerability CVE-2026-17543 was detected. This vulnerability allows attackers to perform SQL injection attacks. To address this issue, users should upgrade PHP to version 8.2.33 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-17543.

In PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9 a critical severity vulnerability CVE-2026-17544 was detected. This vulnerability allows an attacker to cause an out-of-bounds write with stack and heap corruption. To address this issue, users should upgrade PHP to version 8.4.24 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-17544.

In koku-metrics-operator component for OpenShift in affected versions a high severity vulnerability CVE-2026-18381 was detected. This vulnerability allows a user to specify an arbitrary upload URL. To address this issue, users should upgrade OpenShift to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-18381.

In FuseWP component for WordPress versions 1.1.24.2 and earlier a medium severity vulnerability CVE-2026-5582 was detected. This vulnerability allows attackers to trick authenticated users into performing unintended actions. To address this issue, users should upgrade FuseWP to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-5582.

In certain versions of Node a medium severity vulnerability CVE-2026-66922 was detected. This vulnerability allows an attacker to tamper with object prototypes, potentially leading to denial of service or other security bypasses. To address this issue, users should upgrade Node to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-66922.