In Dolibarr versions up to 23.0.2 a medium severity vulnerability CVE-2026-112361 was detected. This vulnerability allows a remote attacker to bypass Content Security Policy (CSP) restrictions, leading to a complete protection mechanism failure that can facilitate Cross-Site Scripting (XSS) or unauthorized data exfiltration. This occurs due to a flaw within the htdocs/document.php file. By manipulating requests to this endpoint, an attacker can neutralize the intended CSP headers or security boundaries. To address this issue, users should upgrade Dolibarr to version 24.0.0 or later (patch commit 9f9ffa2). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-112361.
In Foreman versions from 1.9.0 up to 3.19.1, and Red Hat Satellite versions 6.16 before 6.16.4, 6.17 before 6.17.12, 6.18 before 6.18.10, and 6.19 before 6.19.5 a critical severity vulnerability CVE-2026-96659 was detected. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure, potentially escalating to Remote Code Execution (RCE) under certain configurations. This occurs due to excessive permissions granted on template preview endpoints. By submitting crafted requests to these endpoints, an attacker can access sensitive data such as host root passwords. Furthermore, if the system is insecurely configured with Safemode protections disabled, this flaw allows the execution of arbitrary commands as the Foreman system account. To address this issue, users should upgrade Red Hat Satellite to versions 6.16.4, 6.17.12, 6.18.10, 6.19.5, or later, and apply the corresponding patch for Foreman. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-96659.
Read more IT Business Management
In FreeScout versions prior to 1.8.186 a high severity vulnerability CVE-2025-58163 was detected. This vulnerability allows an authenticated attacker with knowledge of the application’s APP_KEY to achieve Remote Code Execution (RCE). This occurs due to the deserialization of untrusted data during the decryption process. When specific endpoints, such as /help/{mailbox_id}/auth/{customer_id}/{hash}/{timestamp}, process the customer_id and timestamp parameters, they are passed through the decrypt function in app/Helper.php without proper validation. Because the application subsequently deserializes the decrypted payload without sanitization, an attacker can craft malicious serialized PHP objects to trigger arbitrary command execution. To address this issue, users should upgrade FreeScout to version 1.8.186 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-58163.
In FreeIPA versions prior to 4.13.3 a high severity vulnerability CVE-2026-11861 was detected. This vulnerability allows an authenticated Active Directory user to bypass authentication for FreeIPA services and escalate their privileges within the FreeIPA domain. This occurs when a trust relationship is configured between FreeIPA and Active Directory. Because FreeIPA services fail to properly verify Privilege Attribute Certificate (PAC) certificates, an attacker can impersonate a client name in the Ticket Granting Service (TGS). This enables unauthorized access to critical infrastructure components, including the portal, SMB server, and LDAP directory. To address this issue, users should upgrade FreeIPA to version 4.13.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11861.
Read more Security
In FreeIPA versions prior to 4.13.3 a high severity vulnerability CVE-2026-73198 was detected. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) condition through memory exhaustion. This occurs due to an unbounded request body read flaw within the /ipa/i18n_messages endpoint. By sending an arbitrarily large request body to this endpoint, an attacker can force the service to consume excessive memory. This leads to degraded responsiveness and ultimately makes the service unavailable to legitimate users. To address this issue, users should upgrade FreeIPA to version 4.13.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-73198.
In aaPanel versions up to 8.25.0 a medium severity vulnerability CVE-2026-113507 was detected. This vulnerability allows a remote attacker to spoof their IP address and bypass IP-based access restrictions, leading to improper access control. This occurs due to a flaw in the GetClientIp function within the class/public/common.py file. By manipulating the X-Real-Ip HTTP header, an attacker can trick the application into trusting a malicious request as if it originated from a whitelisted or authorized IP address. Warning: A public exploit for this vulnerability is available and could be used in active attacks. The vendor has confirmed that this IP-bypass vulnerability is fixed, though a specific version number was not detailed. To address this issue, users should upgrade aaPanel to any version later than aaPanel 8.25.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-113507.