Our news and updates

In Phoca Cart component for Joomla versions 6.1.6 and earlier a critical severity vulnerability CVE-2026-74251 was detected. This vulnerability allows an unauthenticated attacker to inject arbitrary SQL to extract the full database. To address this issue, users should upgrade Phoca Cart to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-74251.

In OpenShift a high severity vulnerability CVE-2026-15218 was detected. This vulnerability allows an attacker to gain excessive permissions on the cluster. To address this issue, users should upgrade OpenShift to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15218.

In Contact Form, Survey, Quiz & Popup Form Builder – ARForms component for WordPress versions 1.8.5 and earlier a critical severity vulnerability CVE-2024-13784 was detected. This vulnerability allows unauthenticated attackers to inject a PHP Object. To address this issue, users should upgrade Contact Form, Survey, Quiz & Popup Form Builder – ARForms to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-13784.

In WooMS component for WordPress versions 9.14 and earlier a medium severity vulnerability CVE-2026-13700 was detected. This vulnerability allows unauthenticated attackers to perform Server-Side Request Forgery and disclose configured integration credentials. To address this issue, users should upgrade WooMS to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-13700.

In openssl_encrypt component for Python versions before 1.4.0 a critical severity vulnerability CVE-2026-74895 was detected. This vulnerability allows attackers to execute malicious plugins with unrestricted access to the filesystem, network, and subprocesses. To address this issue, users should upgrade openssl_encrypt to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-74895.

In PPWP – Password Protect Pages component for WordPress versions 1.9.21 and earlier a medium severity vulnerability CVE-2026-3639 was detected. This vulnerability allows authenticated attackers to inject arbitrary web scripts in pages. To address this issue, users should upgrade PPWP – Password Protect Pages to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3639.

In Ecwid by Lightspeed Ecommerce Shopping Cart component for WordPress versions before 7.0.9 a medium severity vulnerability CVE-2026-14332 was detected. This vulnerability allows any authenticated user to disconnect the store and take the storefront offline. To address this issue, users should upgrade Ecwid by Lightspeed Ecommerce Shopping Cart to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-14332.

In the Link Factory component for WordPress a critical severity vulnerability CVE-2026-15413 was detected. This vulnerability allows an attacker to gain unauthorized remote control over the website. To address this issue, users should upgrade Link Factory to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15413.

In Mattermost versions 11.9.0 and earlier, 11.8.4 and earlier, 11.7.7 and earlier, and 10.11.22 and earlier a medium severity vulnerability CVE-2026-14298 was detected. This vulnerability allows an authenticated user to cause a denial of service. To address this issue, users should upgrade Mattermost to version 10.11.23 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-14298.