Our news and updates

In Gogs versions up to and including 0.13.3 a critical severity vulnerability CVE-2025-64175 was detected. This vulnerability allows attackers to bypass two-factor authentication due to improper scoping of 2FA recovery codes by user, enabling cross-account reuse of valid recovery codes and resulting in full account takeover when a victim’s credentials are known. To address this issue, users should upgrade Gogs to versions 0.13.4, 0.14.0+dev or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64175.

In PrestaShop versions prior to 8.2.4 and 9.0.3 a medium severity vulnerability CVE-2026-25597 was detected. This vulnerability allows attackers to perform time-based user enumeration in the front-office login form by measuring response time differences to determine whether a customer account exists. To address this issue, users should upgrade PrestaShop to versions 8.2.4, 9.0.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25597.

In Qdrant versions 1.9.3 through before 1.16.0 a high severity vulnerability CVE-2026-25628 was detected. This vulnerability allows attackers with minimal (read-only) privileges to append data to arbitrary files via the `/logger` endpoint by controlling the `on_disk.log_file` path, potentially leading to further system compromise. To address this issue, users should upgrade Qdrant to version 1.16.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25628.

In Zulip versions 5.0 through before 11.5 a low severity vulnerability CVE-2026-24050 was detected. This vulnerability allows attackers to perform stored cross-site scripting (XSS) via crafted group or channel names in the user profile modal, potentially executing malicious scripts when a user interacts with the affected object. To address this issue, users should upgrade Zulip to version 11.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24050.

In Kanboard versions prior to 1.2.50 a medium severity vulnerability CVE-2026-24885 was detected. This vulnerability allows attackers to perform Cross-Site Request Forgery (CSRF) against the `changeUserRole` action in the `ProjectPermissionController` due to improper enforcement of the `application/json` Content-Type, potentially enabling unauthorized modification of project user roles if an authenticated administrator visits a malicious site. To address this issue, users should upgrade Kanboard to version 1.2.50 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24885.

In Gogs versions up to and including 0.13.3 a high severity vulnerability CVE-2026-24135 was detected. This vulnerability allows authenticated users with write access to a repository’s wiki to exploit a path traversal issue in the `updateWikiPage` function by manipulating the `old_title` parameter, enabling deletion of arbitrary files on the server. To address this issue, users should upgrade Gogs to versions 0.13.4, 0.14.0+dev, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24135.

In Gogs versions up to and including 0.13.3 a high severity vulnerability CVE-2026-23633 was detected. This vulnerability allows attackers to exploit a path traversal issue in Git hook editing, enabling arbitrary file read and write operations on the server. To address this issue, users should upgrade Gogs to versions 0.13.4, 0.14.0+dev, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-23633.

In Gogs versions up to and including 0.13.3 a medium severity vulnerability CVE-2026-23632 was detected. This vulnerability allows attackers with read-only repository permissions to modify repository contents due to missing write permission enforcement in the `PUT /repos/:owner/:repo/contents/*` endpoint, resulting in unauthorized commit creation and git push execution. To address this issue, users should upgrade Gogs to versions 0.13.4, 0.14.0+dev, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-23632.

In Gogs versions up to and including 0.13.3 a medium severity vulnerability CVE-2026-22592 was detected. This vulnerability allows authenticated users to trigger a denial-of-service condition by deleting a repository file prior to synchronization, causing the application to crash. To address this issue, users should upgrade Gogs to versions 0.13.4, 0.14.0+dev, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22592.