Our news and updates

In Django versions 6.0 before 6.0.2, 5.2 before 5.2.11 and 4.2 before 4.2.28 a medium severity vulnerability CVE-2025-13473 was detected. This vulnerability allows remote attackers to perform username enumeration via a timing attack in the `django.contrib.auth.handlers.modwsgi.check_password()` function used for authentication with `mod_wsgi`. To address this issue, users should upgrade Django to versions 6.0.2, 5.2.11, 4.2.28 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13473.

In Dolibarr versions up to and including 11.0.3 a medium severity vulnerability CVE-2020-36966 was detected. This vulnerability allows attackers to inject malicious scripts via the LDAP synchronization settings, specifically through the `host`, `slave`, and `port` parameters in `/dolibarr/admin/ldap.php`, potentially enabling arbitrary JavaScript execution and theft of user cookie information. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2020-36966.

In GitLab CE/EE versions 16.8 up to but not including 18.5.0 a low severity vulnerability CVE-2026-1751 was detected. This vulnerability could allow unauthorized users to edit merge request approval rules under certain conditions, potentially undermining workflow and approval integrity. To address this issue, users should upgrade GitLab CE/EE to version 18.5.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1751.

In OpenVPN versions 2.7_alpha1 through 2.7_rc5 a low severity vulnerability CVE-2025-15497 was detected. This vulnerability allows remote authenticated users to trigger an assertion failure due to insufficient epoch key slot processing, resulting in a denial of service. To address this issue, users should upgrade OpenVPN to version 2.7_rc5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-15497.

In NocoDB versions prior to 0.301.0 a medium severity vulnerability CVE-2026-24766 was detected. This vulnerability allows authenticated users with org-level-creator permissions to exploit prototype pollution in the `/api/v2/meta/connection/test` endpoint, causing all database write operations to fail application-wide until the server is restarted, resulting in a denial of service. To address this issue, users should upgrade NocoDB to version 0.301.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24766.

In Django versions 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28 a high severity vulnerability CVE-2026-1287 was detected. This vulnerability allows attackers to perform SQL injection via control characters in column aliases when using `FilteredRelation` in combination with dictionary expansion passed to `QuerySet` methods such as `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`, potentially compromising the database. To address this issue, users should upgrade Django to version 6.0.2, 5.2.11, 4.2.28 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1287.

In Django versions 6.0 before 6.0.2, 5.2 before 5.2.11 and 4.2 before 4.2.28 a high severity vulnerability CVE-2026-1285 was detected. This vulnerability allows remote attackers to cause a potential denial-of-service via `django.utils.text.Truncator` HTML methods (`chars()` and `words()` with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters when processing crafted inputs containing a large number of unmatched HTML end tags. To address this issue, users should upgrade Django to versions 6.0.2, 5.2.11, 4.2.28 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1285.

In Django versions 6.0 before 6.0.2, 5.2 before 5.2.11 and 4.2 before 4.2.28 a high severity vulnerability CVE-2026-1207 was detected. This vulnerability allows remote attackers to perform SQL injection via raster lookups on `RasterField` (PostGIS) by manipulating the band index parameter, potentially compromising the database. To address this issue, users should upgrade Django to versions 6.0.2, 5.2.11, 4.2.28 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1207.

In EGroupware versions prior to 23.1.20260113 and 26.0.20260113 a high severity vulnerability CVE-2026-22243 was detected. This vulnerability allows authenticated attackers to inject arbitrary SQL commands into the WHERE clause of database queries due to improper handling of user input in the Nextmatch filter processing, caused by a PHP type juggling issue during JSON decoding. To address this issue, users should upgrade EGroupware to versions 23.1.20260113 or 26.0.20260113. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22243.