Communication and Collaboration

In Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14 a medium severity vulnerability CVE-2026-3636 was detected. This vulnerability allows a user without elevated permissions to obtain sensitive data regarding team members’ roles. This occurs because the application fails to properly sanitize team member data when it is returned via various team API endpoints. To address this issue, users should upgrade Mattermost to version Version 11.7.0 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3636.

In Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14 a medium severity vulnerability CVE-2026-3473 was detected. This vulnerability allows an authenticated user to access and download files belonging to other users or teams. This occurs due to improper file ownership validation and access control in the Boards API, where crafted requests using valid file IDs are processed without verifying the requester’s permissions. To address this issue, users should upgrade Mattermost to version 11.7.0 and higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3473.

In Mattermost Plugins versions <= 11.5, 11.1.5, 10.13.11, and 11.3.4.0 a medium severity vulnerability CVE-2026-6342 was detected. This vulnerability allows plugin users to create subscriptions to groups that were not whitelisted. This occurs because the system fails to appropriately check for valid namespaces, allowing attackers to bypass restrictions by creating groups that share the same prefix as a whitelisted group. There's no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-6342.

In Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 a low severity vulnerability CVE-2026-34154 was detected. This vulnerability allows users to bypass subscription access controls and gain unauthorized access to subscription-gated groups without completing payment. This occurs due to a flaw in the discourse-subscriptions plugin. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-34154.

In Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 a medium severity vulnerability CVE-2026-33514 was detected. This vulnerability allows an authenticated user to read the name and structured content of form templates intended exclusively for categories they are not authorized to access. This occurs due to missing authorization checks when the form templates feature is enabled, leading to the disclosure of site configuration metadata. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33514.

In Etherpad versions before 1.6.1 a medium severity vulnerability CVE-2015-4085 was detected. This vulnerability allows attackers to access arbitrary files via a directory traversal flaw in the node/hooks/express/tests.js file within the frontend tests component. To address this issue, users should upgrade Etherpad to version 1.6.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2015-4085.

In ArchiveBox versions 0.8.6rc0 and prior a critical severity vulnerability CVE-2026-42601 was detected. This vulnerability allows attackers to achieve Remote Code Execution (RCE) by injecting arbitrary tool arguments. This occurs because the /add/ endpoint accepts a config JSON field that is merged into the crawl configuration without validation and exported as environment variables when archive plugins run. At the time of publication, there are no publicly available patches; users should monitor for updates or apply appropriate mitigations. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42601.

In EGroupware Enterprise Line (EPL) versions before 1.1.20140505, Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta a medium severity vulnerability CVE-2014-2987 was detected. This vulnerability allows remote attackers to hijack the authentication of administrators via multiple cross-site request forgery (CSRF) vectors. This enables attackers to create an administrator user or modify settings, which can be leveraged to execute arbitrary PHP code in conjunction with CVE-2014-2988. To address this issue, users should upgrade to versions 1.1.20140505 (EPL), 1.8.007.20140506 (Community Edition), or 14.1 beta. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2014-2987.

In eGroupware versions before 1.8.004.20120405 a medium severity vulnerability CVE-2012-2211 was detected. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the menuaction parameter to etemplate/process_exec.php. To address this issue, users should upgrade eGroupware to version 1.8.004.20120405. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2012-2211.