Knowledge Base

In Drupal core versions from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, and from 11.2.0 before 11.2.8 a medium severity vulnerability CVE-2025-13080 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) condition via forceful browsing. This occurs due to an Improper Check for Unusual or Exceptional Conditions flaw within the application. An attacker can exploit this weakness by forcibly navigating to specific paths or triggering unexpected application states, which the system fails to handle properly, ultimately leading to service disruption. To address this issue, users should upgrade Drupal core to versions 10.4.9, 10.5.6, 11.1.9, 11.2.8, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13080.

In Elasticsearch versions from 9.2.0 before 9.4.8, and from 9.5.0 before 9.5.5 a medium severity vulnerability CVE-2026-102409 was detected. This vulnerability allows an authenticated user with low privileges to terminate an Elasticsearch node, resulting in a Denial of Service (DoS). This occurs due to an Uncontrolled Recursion (CWE-674) flaw that leads to excessive resource allocation (CAPEC-130). By triggering this recursive behavior, an attacker can exhaust system resources and crash the targeted node, disrupting overall service availability. To address this issue, users should upgrade Elasticsearch to versions 9.4.8, 9.5.5, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-102409.

In Cal.com and Cal.diy versions up to 6.2.0 a medium severity vulnerability CVE-2026-109143 was detected. This vulnerability allows a remote attacker to bypass authorization checks and delete credentials, leading to improper privilege management. This occurs due to a flaw in the credentials.delete function within the /api/trpc/credentials/delete endpoint of the Credentials Handler component. By manipulating the teamId argument, an attacker can perform unauthorized actions on team credentials. Warning: A public exploit for this vulnerability has been disclosed, and the vendor has not yet responded or provided an official patch. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-109143.

In CryptPad versions from 2025.3.1 before 2026.2.2 a high severity vulnerability CVE-2025-51846 was detected. This vulnerability allows a remote, unauthenticated attacker to significantly degrade or completely deny service for all users of a CryptPad instance, leading to a Denial of Service (DoS). This occurs due to an unbounded WebSocket frame flood flaw, where the server fails to properly limit or throttle the rate and volume of incoming WebSocket frames. By sending a continuous, massive number of frames, an attacker can overwhelm the server’s resources and disrupt application availability. To address this issue, users should upgrade CryptPad to version 2026.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-51846.

In Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 a high severity vulnerability CVE-2026-91157 was detected. This vulnerability allows anonymous users to access restricted media and attachments, leading to unauthorized information disclosure. This occurs because sites with secure uploads enabled fail to reconcile existing upload security metadata when a previously public category becomes read-restricted, or when category permissions are modified during a bulk import. As a result, media and attachments uploaded while the category was public retain a public accessibility flag. These files remain reachable by anonymous users through their short upload URLs, even if the associated topics have been deleted. To address this issue, users should upgrade Discourse to versions 2026.9.0, 2026.8.1, 2026.7.3, 2026.1.9, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-91157.

In Budibase versions prior to 3.41.3 a high severity vulnerability CVE-2026-82240 was detected. This vulnerability allows an authenticated app-scoped builder to escalate their privileges and gain unauthorized builder access to unrelated applications within the same tenant. This occurs due to inadequate validation of app-scoped builder role assignments in the public user create and update API endpoints. By submitting a specially crafted request containing manipulated builder.apps fields to the user update API, an attacker can bypass intended access controls and improperly grant builder rights to other applications. To address this issue, users should upgrade Budibase to version 3.41.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-82240.