Communication and Collaboration

In Mattermost versions 11.1.x up to and including 11.1.2, 10.11.x up to and including 10.11.9, 11.2.x up to and including 11.2.1 and Mattermost Plugin Zoom versions up to and including 1.11.0, a high severity vulnerability CVE-2026-0998 was detected. This vulnerability allows attackers to start Zoom meetings as any user and overwrite arbitrary posts via direct API calls with manipulated user IDs and post data due to insufficient validation of user identity and post ownership in the /api/v1/askPMI endpoint. To address this issue, users should upgrade Mattermost and the Mattermost Zoom Plugin to versions 11.3.0, 11.1.3, 10.11.10 or 11.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-0998.

In Zulip versions 5.0 through before 11.5 a low severity vulnerability CVE-2026-24050 was detected. This vulnerability allows attackers to perform stored cross-site scripting (XSS) via crafted group or channel names in the user profile modal, potentially executing malicious scripts when a user interacts with the affected object. To address this issue, users should upgrade Zulip to version 11.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24050.

In EGroupware versions prior to 23.1.20260113 and 26.0.20260113 a high severity vulnerability CVE-2026-22243 was detected. This vulnerability allows authenticated attackers to inject arbitrary SQL commands into the WHERE clause of database queries due to improper handling of user input in the Nextmatch filter processing, caused by a PHP type juggling issue during JSON decoding. To address this issue, users should upgrade EGroupware to versions 23.1.20260113 or 26.0.20260113. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22243.

In LimeSurvey versions up to and including 4.3.10 a medium severity vulnerability CVE-2020-36993 was detected. This vulnerability allows attackers to inject malicious SVG scripts through the Survey Menu parameters, enabling the execution of arbitrary JavaScript in administrative contexts. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2020-36993.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a high severity vulnerability CVE-2025-68934 was detected. This vulnerability allows authenticated users to trigger a denial of service by submitting crafted payloads to the /drafts.json endpoint, causing inefficient O(n²) processing in Base62.decode and tying up worker processes for extended periods. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68934.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 a high severity vulnerability CVE-2025-68933 was detected. This vulnerability allows non-administrator moderators, when the moderators_change_post_ownership setting is enabled, to change ownership of posts in private messages and restricted categories they cannot access, then export the data to view the private content. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68933.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a medium severity vulnerability CVE-2025-68666 was detected. This vulnerability allows users with moderation privileges to access user archives that should be restricted to administrators only, resulting in the exposure of private topic and post content and a breach of confidentiality. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68666.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a high severity vulnerability CVE-2025-68662 was detected. This vulnerability allows attackers to bypass Server-Side Request Forgery (SSRF) protections under certain conditions due to improper hostname validation in the FinalDestination component. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68662.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a medium severity vulnerability CVE-2025-68660 was detected. This vulnerability allows authenticated users to bypass ai_discover_persona access controls, gain unauthorized direct message access to AI personas connected to staff-only resources, and impersonate other users by supplying arbitrary user IDs, potentially leading to unauthorized data disclosure and abusive or misleading private message activity. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68660.