Our news and updates

In Istio versions prior to 1.29.1, 1.28.5, and 1.27.8 a high severity vulnerability CVE-2026-31837 was detected. This vulnerability allows attackers to access hardcoded default key material if the JWKS resolver becomes unavailable or the fetch fails, regardless of the use of the RequestAuthentication resource. To address this issue, users should upgrade Istio to versions 1.29.1, 1.28.5 or 1.27.8. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-31837.

In Kestra versions 1.1.10 and prior a medium severity vulnerability CVE-2026-29082 was detected. This vulnerability allows attackers to execute stored cross-site scripting (XSS) by injecting malicious Markdown (.md) content in the execution-file preview, which is rendered with markdown-it as HTML and injected via Vue’s v-html without sanitization. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29082.

In ZITADEL versions 4.0.0 to 4.12.0 a high severity vulnerability CVE-2026-29193 was detected. This vulnerability allows attackers to bypass login behavior and security policies in the Login V2 UI, enabling self-registration of new accounts or signing in with a password even if these options were disabled in their organization. To address this issue, users should upgrade ZITADEL to version 4.12.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29193.

In changedetection.io versions prior to 0.54.4 a critical severity vulnerability CVE-2026-29065 was detected. This vulnerability allows attackers to overwrite arbitrary files via path traversal in the backup restore functionality by uploading crafted ZIP archives (Zip Slip). To address this issue, users should upgrade changedetection.io to version 0.54.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29065.

In changedetection.io versions prior to 0.54.4 a medium severity vulnerability CVE-2026-29039 was detected. This vulnerability allows attackers to read arbitrary files on the server by supplying malicious XPath expressions using the unparsed-text() function via the include_filters field. To address this issue, users should upgrade changedetection.io to version 0.54.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29039.

In changedetection.io versions prior to 0.54.4 a medium severity vulnerability CVE-2026-29038 was detected. This vulnerability allows attackers to execute reflected cross-site scripting (XSS) by injecting malicious JavaScript through the tag_uuid parameter in the /rss/tag/ endpoint, which is rendered without HTML escaping. To address this issue, users should upgrade changedetection.io to version 0.54.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29038.

In Ghost versions 5.101.6 to 6.19.2 a high severity vulnerability CVE-2026-29784 was detected. This vulnerability allows attackers to exploit incomplete CSRF protections around the /session/verify endpoint, enabling the use of one-time codes (OTCs) in login sessions different from the requesting session. In some scenarios, this could have made it easier for phishers to take over a Ghost site. To address this issue, users should upgrade Ghost to version 6.19.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29784.

In Budibase versions 3.31.5 and earlier a critical severity vulnerability CVE-2026-30240 was detected. This vulnerability allows an authenticated user with builder privileges to perform path traversal via the PWA ZIP processing endpoint (`POST /api/pwa/process-zip`), enabling reading of arbitrary files on the server, including `/proc/1/environ` containing JWT secrets, database credentials, encryption keys, and API tokens. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-30240.

In Budibase versions 3.24.0 and earlier a high severity vulnerability CVE-2026-25737 was detected. This vulnerability allows an attacker to bypass file extension restrictions enforced at the UI level and upload arbitrary malicious files to the server. Exploiting this vulnerability can lead to code execution or compromise of the platform. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25737.