Communication and Collaboration

In Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 (with earlier unsupported versions potentially affected) a high severity vulnerability CVE-2026-15307 was detected. This vulnerability allows an attacker to perform arbitrary server-side file writes and Server-Side Request Forgery (SSRF), potentially leading to Remote Code Execution (RCE). This occurs because GeoDjango spatial lookups optimistically parse right-hand-side values as a raster by passing them to the django.contrib.gis.gdal.GDALRaster constructor. If untrusted input reaches this constructor—for example, via a spatial-field filter submitted through the Django admin changelist by a user with view permissions—the system can be exploited. Passing a dictionary or its JSON string representation causes it to be opened in write mode regardless of default settings, allowing the creation of files with attacker-chosen names and contents via a file-backed GDAL driver. Additionally, passing other string values can trigger outbound network requests through GDAL virtual filesystem handlers. To address this issue, users should upgrade Django to versions 5.2.17, 6.0.8, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15307.

In Mattermost versions 11.8.0 and earlier, 11.7.3 and earlier, 11.6.5 and earlier, and 10.11.20 and earlier a medium severity vulnerability CVE-2026-7521 was detected. This vulnerability allows an administrator to delete arbitrary files on the server. To address this issue, users should upgrade Mattermost to version 10.11.21 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7521.

In EGroupware affected versions a high severity vulnerability CVE-2026-27823 was detected. This vulnerability allows an authenticated attacker to execute arbitrary commands on the server. To address this issue, users should upgrade EGroupware to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27823.

In Mattermost versions 10.11.18 and earlier, 11.6.3 and earlier, and 11.5.6 and earlier a low severity vulnerability CVE-2026-3472 was detected. This vulnerability allows an authenticated attacker to exfiltrate data. To address this issue, users should upgrade Mattermost to version 10.11.19 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3472.

In Mattermost Agents component for Mattermost versions 10.11.18, 11.6.3, 11.5.6 and earlier a medium severity vulnerability CVE-2026-4339 was detected. This vulnerability allows an attacker to perform server-side request forgery (SSRF) and exfiltrate data from internal network services. To address this issue, users should upgrade Mattermost to version 10.11.19 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-4339.

In ArchiveBox versions up to and including 0.6.2 a medium severity vulnerability CVE-2023-45815 was detected. This vulnerability allows an attacker to execute malicious JavaScript in the context of a user’s session, leading to Stored Cross-Site Scripting (XSS) and potential account takeover. This occurs because ArchiveBox serves archived content from the same host and port as its admin panel, which bypasses standard browser CORS and CSRF protections. If a user utilizes the wget extractor to archive a maliciously crafted page and subsequently views the output, the embedded JavaScript executes. For authenticated administrators, this allows the script to silently perform admin actions, such as adding, modifying, or removing snapshots and users. For unauthenticated users, the script can still read all other archived content. To address this issue, users should upgrade ArchiveBox to version 0.9.0 or later. As a temporary mitigation, administrators can disable the wget extractor by setting SAVE_WGET=False, ensure they are logged out before viewing archives, or serve a static HTML version of the archive. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2023-45815.

In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-44779 was detected. This vulnerability allows unauthorized access to sensitive information. This occurs because the bot debug endpoints inadvertently disclose whisper translation audit logs. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44779.

In Rocket.Chat versions prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, and 7.10.13 a high severity vulnerability CVE-2026-48929 was detected. This vulnerability allows an unauthenticated attacker to permanently delete any uploaded file by its ID. This occurs because calling the deleteFileMessage Meteor method via an unauthenticated DDP WebSocket connection causes Meteor.userId() to return null, which improperly skips the authorization check. The execution then falls through to unconditionally remove the file from storage and the database using FileUpload.getStore('Uploads').deleteById(fileID). Because file IDs are easily discoverable via public channel message payloads and download URLs, an attacker can target and destroy specific files. To address this issue, users should upgrade Rocket.Chat to versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, or 7.10.13. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48929.

In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a high severity vulnerability CVE-2026-44786 was detected. This vulnerability allows an unauthorized user, specifically a MessageBus subscriber who does not have chat enabled, to receive real-time chat message payloads, leading to information disclosure. This occurs because chat events for public category channels are published to the MessageBus without proper permission scoping. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44786.