Security fixes and Disclosures
Security vulnerabilities fixed in DekkoSecure software (AU region, au.dekko.io) are listed at the next review after the fix is live; this page is reviewed at least every 90 days. To report a vulnerability, see Vulnerability Disclosure.
DKS-2026-0763: Image library updated for published vulnerabilities
| Product (CPE) | cpe:2.3:a:dekkosecure:dekkocore:7.4.0:*:*:*:*:*:*:* |
| Weakness (CWE) | CWE-787 Out-of-bounds Write (CVE-2025-27598 in the SixLabors.ImageSharp library) |
| Fixed in | DekkoCORE 7.4.0, October 2026 |
The image library that processes profile photos was updated to a release that fixes its published vulnerabilities.
DKS-2026-0592: Passkey trust list was out of date
| Product (CPE) | cpe:2.3:a:dekkosecure:dekkocore:7.4.0:*:*:*:*:*:*:* |
| Weakness (CWE) | CWE-299 Improper Check for Certificate Revocation |
| Fixed in | DekkoCORE 7.4.0, October 2026 |
The list of trusted passkey devices and their revocation status was refreshed to the current FIDO Metadata Service release.
DKS-2026-0417: PDF viewer could compile code from a PDF's fonts
| Product (CPE) | cpe:2.3:a:dekkosecure:dekkocore:7.4.0:*:*:*:*:*:*:* |
| Weakness (CWE) | CWE-95 Eval Injection (CVE-2024-4367 in the pdf.js library) |
| Fixed in | DekkoCORE 7.4.0, October 2026 |
The PDF viewer no longer compiles code from a PDF's fonts.
DKS-2026-001: Browser policy allowed inline scripts
| Severity | Low |
| Product (CPE) | cpe:2.3:a:dekkosecure:dekkocore:7.4.0:*:*:*:*:*:*:* |
| Fixed in | DekkoCORE 7.4.0, September 2026 |
| Weakness (CWE) | CWE-693 Protection Mechanism Failure |
| Exploited | No |
| Action needed | None |
The Content Security Policy now blocks inline scripts and eval.
Was this article helpful?
Didn't find what you need?Ask the AI assistant about this topic, or contact support.
Request support