Our news and updates

In SP Page Builder component for Joomla versions prior to 6.7.1 a high severity vulnerability CVE-2026-65877 was detected. This vulnerability allows an authenticated attacker to execute arbitrary SQL commands on the database. To address this issue, users should upgrade SP Page Builder to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-65877.

In Directus versions prior to 12.1.0 a high severity vulnerability CVE-2026-10716 was detected. This vulnerability allows an authenticated administrator to execute arbitrary SQL commands, potentially leading to unauthorized data extraction via time-based blind SQL Injection (SQLi). This occurs during the collection creation flow when the instance uses PostgreSQL with the PostGIS extension enabled. By supplying a malicious fields[].type value that starts with geometry but is followed by attacker-controlled SQL syntax, an attacker can bypass input validation and manipulate the underlying database queries. To address this issue, users should upgrade Directus to version 12.1.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-10716.

In the Kubernetes Java client library component for Kubernetes in unspecified versions a unknown severity vulnerability CVE-2026-15687 was detected. This vulnerability allows a compromised pod to create new files in arbitrary locations on the client machine. To address this issue, users should upgrade the Kubernetes Java client library to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15687.

In Java a medium severity vulnerability CVE-2026-12353 was detected. This vulnerability allows an unauthenticated attacker to trigger an Out of Memory condition to crash the Java process. To address this issue, users should upgrade Java to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-12353.

In WPO365 | Login component for WordPress versions 43.2 and earlier a high severity vulnerability CVE-2026-15212 was detected. This vulnerability allows an attacker to modify the plugin’s settings via a specially crafted request. To address this issue, users should upgrade WPO365 | Login to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15212.

In SAML Single Sign On – SSO Login component for WordPress versions up to and including 5.4.4 a critical severity vulnerability CVE-2026-15981 was detected. This vulnerability allows attackers to bypass authentication. To address this issue, users should upgrade SAML Single Sign On – SSO Login to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15981.

In Cal versions 4.7.15 and earlier a high severity vulnerability CVE-2024-58353 was detected. This vulnerability allows an attacker to inject arbitrary HTML or JavaScript. To address this issue, users should upgrade Cal to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-58353.

In Clover Payment Gateway by Zaytech component for WooCommerce versions before 1.3.6 a high severity vulnerability CVE-2026-12493 was detected. This vulnerability allows unauthenticated users to mark arbitrary orders as paid. To address this issue, users should upgrade Clover Payment Gateway by Zaytech to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-12493.

In MongoDB versions prior to 7.0.39 a medium severity vulnerability CVE-2026-13066 was detected. This vulnerability allows for the disclosure of internal process memory contents. To address this issue, users should upgrade MongoDB to version 7.0.39 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-13066.