Our news and updates

In NocoDB versions prior to 0.301.0 a high severity vulnerability CVE-2026-24769 was detected. This vulnerability allows authenticated attackers to upload malicious SVG files containing embedded JavaScript, which are later executed in the browsers of users who view the attachment, potentially leading to account compromise, data exfiltration, and unauthorized actions. To address this issue, users should upgrade NocoDB to version 0.301.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24769.

In NocoDB versions prior to 0.301.0 a medium severity vulnerability CVE-2026-24768 was detected. This vulnerability allows attackers to perform unvalidated redirects via the `continueAfterSignIn` parameter in the login flow, potentially redirecting users to arbitrary external websites and enabling phishing attacks. To address this issue, users should upgrade NocoDB to version 0.301.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24768.

In NocoDB versions prior to 0.301.0 a medium severity vulnerability CVE-2026-24767 was detected. This vulnerability allows attackers to perform blind Server-Side Request Forgery (SSRF) via unvalidated `HEAD` requests in the `uploadViaURL` functionality, enabling limited outbound requests to arbitrary URLs before SSRF protections are enforced. To address this issue, users should upgrade NocoDB to version 0.301.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24767.

In EGroupware versions prior to 23.1.20260113 and 26.0.20260113 a high severity vulnerability CVE-2026-22243 was detected. This vulnerability allows authenticated attackers to inject arbitrary SQL commands into the WHERE clause of database queries due to improper handling of user input in the Nextmatch filter processing, caused by a PHP type juggling issue during JSON decoding. To address this issue, users should upgrade EGroupware to versions 23.1.20260113 or 26.0.20260113. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22243.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a high severity vulnerability CVE-2025-68934 was detected. This vulnerability allows authenticated users to trigger a denial of service by submitting crafted payloads to the /drafts.json endpoint, causing inefficient O(n²) processing in Base62.decode and tying up worker processes for extended periods. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68934.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 a high severity vulnerability CVE-2025-68933 was detected. This vulnerability allows non-administrator moderators, when the moderators_change_post_ownership setting is enabled, to change ownership of posts in private messages and restricted categories they cannot access, then export the data to view the private content. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68933.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a medium severity vulnerability CVE-2025-68666 was detected. This vulnerability allows users with moderation privileges to access user archives that should be restricted to administrators only, resulting in the exposure of private topic and post content and a breach of confidentiality. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68666.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a high severity vulnerability CVE-2025-68662 was detected. This vulnerability allows attackers to bypass Server-Side Request Forgery (SSRF) protections under certain conditions due to improper hostname validation in the FinalDestination component. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68662.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a medium severity vulnerability CVE-2025-68660 was detected. This vulnerability allows authenticated users to bypass ai_discover_persona access controls, gain unauthorized direct message access to AI personas connected to staff-only resources, and impersonate other users by supplying arbitrary user IDs, potentially leading to unauthorized data disclosure and abusive or misleading private message activity. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68660.