September has been an unusually active month for the Bacularis project, with three releases published in less than three weeks. After the release of Bacularis 6.5.0, which introduced the new Restore Verification feature to the interface, two CVE vulnerabilities were reported. The project reacted quickly. Just five days after the release of 6.5.0, version 6.5.1 was published with fixes for the reported issues and initial hardening of similar code patterns.
After addressing those two vulnerabilities and carrying out the first hardening improvements in version 6.5.1, two additional security reports were submitted to the project on the same day. The response was again quick, but this time the scope of the work was expanded well beyond fixes for those specific issues.
The developers started a broader review of related data validation, processing and safe output-handling mechanisms across the application. More information about this security review and the additional hardening work can be found in the Bacularis Project Report published on September 12, 2026.
The result of this work was Bacularis 6.5.2, which includes fixes for the two newly reported CVEs as well as additional security improvements and hardening across the application. Part of this work was preventive and was not directly related to the specific vulnerabilities that had been reported.
With the release of Bacularis 6.5.2, all four reported CVE issues described above have been addressed, while the application has also gained additional security improvements and hardening.
From a practical point of view, the most important step for users is to update Bacularis to the latest version, something the project developers also encourage. Detailed information about the changes introduced in versions 6.5.1 and 6.5.2 can be found in their official release notes.
Sources:
Bacularis 6.5.2 - release notes