Our news and updates

In GitLab Enterprise Edition (EE) versions 6.6.0 before 6.6.2 a medium severity vulnerability CVE-2014-3456 was detected. This vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, leading to Cross-Site Scripting (XSS). To address this issue, users should upgrade GitLab Enterprise Edition (EE) to version 6.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2014-3456.

In Django versions 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 a medium severity vulnerability CVE-2015-8213 was detected. This vulnerability allows remote attackers to obtain sensitive application secrets (such as the SECRET_KEY) by providing a settings key in place of a date/time format setting to the get_format function in utils/formats.py. To address this issue, users should upgrade Django to versions 1.7.11, 1.8.7, or 1.9rc2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2015-8213.

In Drupal versions 6.x before 6.38 a medium severity vulnerability CVE-2016-3165 was detected. This vulnerability allows remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has the “#access” attribute set to FALSE in the server-side form definition, as the Form API ignores these restrictions on submit buttons. To address this issue, users should upgrade Drupal to version 6.38. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2016-3165.

In Budibase versions prior to 3.35.10 a high severity vulnerability CVE-2026-42239 was detected. This vulnerability allows attackers to steal JWT session tokens and achieve full account takeover if a Cross-Site Scripting (XSS) vulnerability is present, because the budibase:auth session cookie is set without the httpOnly, secure, and sameSite attributes. To address this issue, users should upgrade Budibase to version 3.35.10. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42239.

In Argo CD versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9 a critical severity vulnerability CVE-2026-42880 was detected. This vulnerability allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server’s Server-Side Apply dry-run mechanism due to a missing authorization and data-masking gap in Argo CD’s ServerSideDiff endpoint. To address this issue, users should upgrade Argo CD to versions 3.2.11 or 3.3.9. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42880.

In FreeIPA versions 3.0 before 3.1.2 a medium severity vulnerability CVE-2013-0199 was detected. This vulnerability allows remote attackers to obtain the Cross-Realm Kerberos Trust key via unspecified vectors due to default LDAP ACIs failing to restrict access to the ipaNTTrustAuthIncoming and ipaNTTrustAuthOutgoing attributes. To address this issue, users should upgrade FreeIPA to version 3.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2013-0199.

In Dolibarr versions prior to 23.0.0 a critical severity vulnerability CVE-2026-23500 was detected. This vulnerability allows authenticated administrators to inject arbitrary OS commands and achieve remote code execution (RCE) as the web server user by manipulating the MAIN_ODT_AS_PDF configuration constant during the ODT to PDF conversion process. To address this issue, users should upgrade Dolibarr to version 23.0.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-23500.

In Foreman versions before 1.12.2 a medium severity vulnerability CVE-2016-6319 was detected. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the label parameter in app/helpers/form_helper.rb, as used by Remote Execution and possibly other plugins. To address this issue, users should upgrade Foreman to version 1.12.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2016-6319.

In Elasticsearch versions before 1.4.5 and 1.5.x before 1.5.2 a medium severity vulnerability CVE-2015-3337 was detected. This vulnerability allows remote attackers to read arbitrary files via unspecified vectors when a site plugin is enabled, due to a directory traversal flaw. To address this issue, users should upgrade Elasticsearch to versions 1.4.5 or 1.5.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2015-3337.