Our news and updates

In GitLab CE/EE versions 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 a medium severity vulnerability CVE-2026-9807 was detected. This vulnerability allows an attacker using a blocked Project Access Token to continue accessing private resources. This occurs due to incorrect authorization enforcement within the application under certain conditions. To address this issue, users should upgrade GitLab CE/EE to versions 18.10.7, 18.11.4, or 19.0.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-9807.

In Kibana versions 8.0.0 up a medium severity vulnerability CVE-2026-49094 was detected. This vulnerability allows an authenticated user with viewer-level access to cause a Denial of Service (DoS), rendering the application unavailable to all users until it is manually recovered. This occurs due to uncontrolled resource consumption (excessive CPU and memory allocation) when a request containing an oversized input value is submitted to an analytics collections management endpoint. To address this issue, users should upgrade Kibana to version 8.19.16, 9.3.5, and 9.4.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-49094.

In Budibase versions prior to 3.39.0 a high severity vulnerability CVE-2026-48151 was detected. This vulnerability allows an unauthenticated attacker to update the body schema for a known webhook and mutate the corresponding automation trigger output schema. This occurs because the generic authorization middleware improperly skips authorization for all paths matching /api/webhooks/schema, bypassing the intended restrictions for endpoints registered under builderRoutes. To address this issue, users should upgrade Budibase to version 3.39.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48151.

In GitLab CE/EE versions 18.2 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 a medium severity vulnerability CVE-2026-6713 was detected. This vulnerability allows an unauthorized user to enumerate private projects under certain conditions. This occurs due to incorrect authorization checks within the application. To address this issue, users should upgrade GitLab CE/EE to versions 18.10.7, 18.11.4, or 19.0.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-6713.

In Joomla! Framework versions Versions 1.0.0 through 3.0.5 and versions 4.0.0through 4.0.1 a medium severity vulnerability CVE-2026-48903 was detected. This vulnerability allows an attacker to execute arbitrary malicious scripts (Cross-Site Scripting, XSS) in the context of the victim’s browser. This occurs due to inadequate content filtering within the checkAttribute methods, which affects various components. To address this issue, users should upgrade Joomla! Framework to version 5.4.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48903.

In Kibana version 9.3.3 a medium severity vulnerability CVE-2026-49093 was detected. This vulnerability allows an authenticated user with connector management privileges to perform a Server-Side Request Forgery (SSRF) attack. This occurs because the application allows the user to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations that the egress controls were intended to block. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-49093.

In Moodle LMS version 4.0 a medium severity vulnerability CVE-2022-50943 was detected. This vulnerability allows an unauthenticated attacker to execute arbitrary scripts in a user’s browser and potentially steal session cookies (Cross-Site Scripting). This occurs because malicious payloads can be injected through the unescaped “search” parameter in the course/search.php file. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2022-50943.

In GitLab CE/EE versions 12.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 a medium severity vulnerability CVE-2026-8716 was detected. This vulnerability allows an authenticated user to access CI data from a different ref type than intended under certain conditions. This occurs due to the use of an incorrectly-resolved name or reference within the application. To address this issue, users should upgrade GitLab CE/EE to versions 18.10.7, 18.11.4, or 19.0.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-8716.

In Budibase versions prior to 3.39.0 a high severity vulnerability CVE-2026-48153 was detected. This vulnerability allows an attacker to perform a Server-Side Request Forgery (SSRF) attack, potentially exposing internal hosts and cloud metadata. This occurs because the fetchToken function in the OAuth2 SDK makes a POST request to a builder-supplied URL without applying the standard blacklist.isBlacklisted check, allowing requests to arbitrary hosts without scheme or host restrictions. To address this issue, users should upgrade Budibase to version 3.39.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48153.