In Directus versions prior to 11.13.0 a medium severity vulnerability CVE-2025-64748 was detected. This vulnerability allows an authenticated user to perform enumeration attacks and deduce the contents of concealed or sensitive fields. This occurs because concealed fields remain searchable if the user has read permissions for them. Although the actual values of these fields are properly masked (e.g., displaying as ****) in the application’s response, successful search queries still return the corresponding records. By systematically adjusting search parameters and observing which queries yield results, an attacker can brute-force and uncover the hidden data. To address this issue, users should upgrade Directus to version 11.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64748.
In Appsmith versions prior to 2.1 a critical severity vulnerability CVE-2026-55455 was detected. This vulnerability allows an authenticated user to perform Server-Side Request Forgery (SSRF) attacks, enabling them to craft outbound requests that reach loopback-bound services inside the container. This occurs due to a flawed outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins). The filter only validates hosts against an exact-match string denylist, completely bypassing the comprehensive address-class checks (such as loopback, any-local, link-local, and fc00::/7) that are correctly implemented on a separate code path used by SMTP. To address this issue, users should upgrade Appsmith to version 2.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-55455.
In aaPanel versions up to 8.25.0 a medium severity vulnerability CVE-2026-113505 was detected. This vulnerability allows a remote, authenticated attacker to read arbitrary files on the server via a Path Traversal (Local File Inclusion) attack. This occurs due to insufficient validation in the send_file function within the BTPanel/routes/v2.py file of the Download Endpoint component. By manipulating the filename argument, an attacker can traverse directory structures and access sensitive files outside the intended download directory. Warning: A public exploit for this vulnerability is available and could be used in active attacks. The vendor has confirmed the issue, noting that exploitation requires prior authentication. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-113505.
In Budibase versions prior to 3.40.0 a high severity vulnerability CVE-2026-73617 was detected. This vulnerability allows an attacker to bypass per-user access controls, read arbitrary documents, execute JavaScript, or modify collections through unauthorized update and delete operations. This occurs due to a NoSQL injection flaw within the MongoDB datasource integration. Specifically, user-supplied parameters are enriched using Handlebars with the noEscaping: true setting and then parsed without proper operator filtering. This enables attackers to inject malicious MongoDB operators (such as the $where operator) directly via query parameters. To address this issue, users should upgrade Budibase to version 3.40.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-73617.
In Argo CD versions from 2.7.0 prior to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 a critical severity vulnerability CVE-2026-113708 was detected. This vulnerability allows an attacker to execute arbitrary commands inside the argocd-repo-server and access sensitive data, including repository credentials. This occurs due to a command injection flaw when Kustomize processes remote resource, base, or component URLs. Because it passes ref or version query values to git fetch without an end-of-options separator, an attacker can supply a leading-hyphen value that is inadvertently parsed as the --upload-pack flag. When combined with a local transport such as file://, this triggers the execution of an attacker-controlled command. The attack can be launched by committing a malicious Kustomization to a Git repository or by uploading files via the API, which requires only basic Application ‘get’ permissions. To address this issue, users should upgrade Argo CD to versions 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-113708.
In Argo CD versions from 0.9.0 prior to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 a critical severity vulnerability CVE-2026-113672 was detected. This vulnerability allows an attacker to read arbitrary files from the repo-server and potentially cause a Denial of Service (DoS). This occurs because the repo-server evaluates .jsonnet files using an importer that fails to confine import, importstr, or importbin statements to the repository root. By utilizing absolute paths, parent-directory traversal, or symlinks, an attacker can access sensitive data such as /proc/self/environ, service-account tokens, and repository credentials, and expose them by placing the imported contents into a ConfigMap. Furthermore, importing a non-terminating device like /dev/zero can exhaust repo-server memory. An attacker can exploit this by committing a malicious .jsonnet file to a Git repository or by uploading it via the API, which only requires basic Application ‘get’ permissions. To address this issue, users should upgrade Argo CD to versions 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-113672.