In aaPanel versions up to 8.25.0 a high severity vulnerability CVE-2026-113506 was detected. This vulnerability allows a remote, authenticated attacker to execute arbitrary OS commands, potentially leading to Remote Code Execution (RCE) and full system compromise. This occurs due to an OS command injection flaw within the ExecShell function of the class/public/common.py file in the File Manager component. By manipulating specific arguments—such as sfile, dfile, access, or user—an attacker can inject and execute malicious commands directly on the host operating system. Warning: A public exploit for this vulnerability is available and could be used in active attacks. The vendor has confirmed the issue, noting that exploitation requires prior authentication. There is currently no official fixed version available. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-113506.
In Argo CD versions from 2.1.0 prior to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 a critical severity vulnerability CVE-2026-113709 was detected. This vulnerability allows an attacker to execute arbitrary code within the argocd-repo-server and access sensitive data, including repository credentials. This occurs when an operator has enabled the --enable-helm flag for Kustomize builds. An attacker can manipulate helmGlobals.configHome to point Helm’s configuration directories to a repository-controlled location containing a malicious downloader plugin. When Helm processes a repository URL using the plugin’s protocol, it automatically loads and executes the attacker’s program. This attack can be triggered either by committing the malicious files to a Git repository or by uploading them via the POST /api/v1/applications/manifestsWithFiles API endpoint (which only requires basic Application ‘get’ permissions). To address this issue, users should upgrade Argo CD to versions 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-113709.
In Directus versions prior to 11.13.0 a medium severity vulnerability CVE-2025-64747 was detected. This vulnerability allows an authenticated user with “upload files” and “edit item” permissions to inject malicious JavaScript, leading to Stored Cross-Site Scripting (XSS). This occurs due to a flaw in the Block Editor interface where input is improperly sanitized. An attacker can bypass Content Security Policy (CSP) restrictions by combining file uploads with iframe srcdoc attributes, resulting in persistent script execution whenever other users view the compromised content. To address this issue, users should upgrade Directus to version 11.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64747.
In aaPanel versions up to 8.25.0 a medium severity vulnerability CVE-2026-113507 was detected. This vulnerability allows a remote attacker to spoof their IP address and bypass IP-based access restrictions, leading to improper access control. This occurs due to a flaw in the GetClientIp function within the class/public/common.py file. By manipulating the X-Real-Ip HTTP header, an attacker can trick the application into trusting a malicious request as if it originated from a whitelisted or authorized IP address. Warning: A public exploit for this vulnerability is available and could be used in active attacks. The vendor has confirmed that this IP-bypass vulnerability is fixed, though a specific version number was not detailed. To address this issue, users should upgrade aaPanel to any version later than aaPanel 8.25.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-113507.
In Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 a high severity vulnerability CVE-2026-91156 was detected. This vulnerability allows an authenticated user to receive live and recent chat messages from a read-restricted category, leading to unauthorized information disclosure. This occurs due to a flaw in the MessageBus audience calculation. The publication path bounded events solely by category visibility without enforcing the site’s group restrictions for Chat eligibility. Consequently, users who were permitted to view the category but explicitly denied access to Chat could still intercept live message content exposed in the MessageBus backlog. Note that this issue does not permit retrieval of the channel’s full history through the Chat API, nor does it allow message creation or modification. To address this issue, users should upgrade Discourse to versions 2026.9.0, 2026.8.1, 2026.7.3, 2026.1.9, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-91156.
Read more Communication
In Directus versions prior to 11.13.0 a medium severity vulnerability CVE-2025-64746 was detected. This vulnerability can unintentionally grant roles unauthorized access to read or modify data. This occurs due to improper permission handling on deleted fields. When a field is removed from a collection, Directus fails to clean up its field-level permissions, leaving the reference in the permissions table intact. If an administrator later creates a new field using the exact same name, this new field automatically inherits the outdated, stale permission entries. This security gap is particularly risky in multi-tenant or production environments where field names might be reused under the assumption that old permissions were fully cleared. To address this issue, users should upgrade Directus to version 11.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64746.
Read more CMS