On 22 October 2026, a critical vulnerability was disclosed in the decoder of Google’s Brotli compression library. It is widely reported as “Broccoli2Shell”, “Node2Shell” or “HTTP2Shell”. An invalid block switch in a crafted Brotli stream is treated as a request for more input. A remote, unauthenticated attacker who can get a vulnerable decoder to process their data may be able to leak memory, crash the process, or run code.
Read MoreSkyve 9.4.4 is a maintenance release that updates third-party dependencies and fixes the Popout action on desktop renderer list grids.
Read MoreThis release of Skyve is a security hardening update for the reporting subsystem.
Read MoreAI works best inside constraints. Skyve's low-code, metadata-driven architecture gives AI-assisted enterprise development the structure and validation it needs.
Read MoreThis release of Skyve introduces improvements to web error handling and enhanced security auditing for concurrent user sessions.
Read MoreCVE-2025-10492 is a newly disclosed Java deserialisation vulnerability affecting Jaspersoft’s JasperReports library that could allow remote code execution in some deployments. While this issue has been patched in commercial editions, community releases are still pending. Skyve is not affected due to its use of trusted local report templates and the absence of remote deserialisation — but we outline what the vulnerability means, who is at risk, and how we’re responding.
Read MoreThis release of Skyve includes improvements to security configuration persistence and email notifications, as well as important bug fixes for the responsive renderer and enhancements to the SAIL testing framework.
Read MoreSkyve 9.4.0 includes a number of new features and improvements, such as router merging changes, audit archiving, module query imports, and enhancements to both the desktop and responsive renderers. Additionally, there are numerous performance and security improvements.
The recently disclosed CVE-2025-48976 vulnerability in Apache Commons FileUpload does not affect Skyve 9. Skyve 8 is only conditionally vulnerable when using the commons uploader with an outdated JSF version. Recommended mitigations are provided for affected configurations.
Read More