Our news and updates

In @fastify/busboy component for Node versions 3.1.0 through 3.2.0 a high severity vulnerability CVE-2026-19484 was detected. This vulnerability allows a remote unauthenticated attacker to stall the Node.js event loop. To address this issue, users should upgrade @fastify/busboy to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19484.

In SQLite in affected versions a medium severity vulnerability CVE-2025-41771 was detected. This vulnerability allows an authenticated attacker to perform a SQL injection. To address this issue, users should upgrade SQLite to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-41771.

In Cotton Cloud component for Joomla versions earlier than 2.0.3 a medium severity vulnerability CVE-2026-67284 was detected. This vulnerability allows authenticated users to perform unauthorized file operations on files owned by other users. To address this issue, users should upgrade Cotton Cloud to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-67284.

In Apache Airflow versions before 22.3.0 a medium severity vulnerability CVE-2026-68868 was detected. This vulnerability allows an attacker to resolve another team’s Connection or Variable, obtaining its credentials in full. To address this issue, users should upgrade Apache Airflow to version 22.3.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-68868.

In Wallet System for WooCommerce component for WooCommerce versions before 2.7.10 a medium severity vulnerability CVE-2026-15045 was detected. This vulnerability allows authenticated customers to arbitrarily reduce their own order total without paying the merchant. To address this issue, users should upgrade Wallet System for WooCommerce to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15045.

In Fabrik component for Joomla versions before 4.6.8 a critical severity vulnerability CVE-2026-67282 was detected. This vulnerability allows an unauthenticated attacker to execute arbitrary code. To address this issue, users should upgrade Fabrik to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-67282.

In GitLab EE versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 a high severity vulnerability CVE-2026-19228 was detected. This vulnerability allows an authenticated user to cause their AI usage to be attributed to another namespace. This occurs due to an Authorization Bypass Through User-Controlled Key flaw, where identity information supplied in requests is improperly authorized. By manipulating this information under certain conditions, an attacker can bypass intended access controls and shift AI usage accounting to a different tenant or namespace. To address this issue, users should upgrade GitLab EE to versions 19.1.4, 19.2.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19228.

In FreeIPA versions before 4.13.3 a high severity vulnerability CVE-2026-73197 was detected. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by exhausting system memory and disrupting service availability. This occurs due to an unbounded request body read flaw in the /ipa/migration/migration.py endpoint. When processing form POST requests, the migration handler reads the entire, attacker-controlled request body directly into memory without enforcing size limits. By sending oversized requests, an attacker can force excessive memory consumption and severely slow down request handling. There’s no fix available for this issue at the moment. . For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-73197.

In OpenShift versions prior to the latest patch a high severity vulnerability CVE-2026-50236 was detected. This vulnerability allows authenticated attackers to make arbitrary network requests from the server’s privileged network position. To address this issue, users should upgrade OpenShift to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50236.