Dolibarr 23.0.0: PHP eval() whitelist bypass → RCE via two bugs (CVE-2026-22666)jivasecurity.com·2 pts·jiva·1
EspoCRM: Formula engine and path traversal → RCE in six requests(CVE-2026-33656)jivasecurity.com·1 pts·jiva·0