Communication and Collaboration

In Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 a low severity vulnerability CVE-2026-34154 was detected. This vulnerability allows users to bypass subscription access controls and gain unauthorized access to subscription-gated groups without completing payment. This occurs due to a flaw in the discourse-subscriptions plugin. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-34154.

In Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 a medium severity vulnerability CVE-2026-33514 was detected. This vulnerability allows an authenticated user to read the name and structured content of form templates intended exclusively for categories they are not authorized to access. This occurs due to missing authorization checks when the form templates feature is enabled, leading to the disclosure of site configuration metadata. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33514.

In Etherpad versions before 1.6.1 a medium severity vulnerability CVE-2015-4085 was detected. This vulnerability allows attackers to access arbitrary files via a directory traversal flaw in the node/hooks/express/tests.js file within the frontend tests component. To address this issue, users should upgrade Etherpad to version 1.6.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2015-4085.

In ArchiveBox versions 0.8.6rc0 and prior a critical severity vulnerability CVE-2026-42601 was detected. This vulnerability allows attackers to achieve Remote Code Execution (RCE) by injecting arbitrary tool arguments. This occurs because the /add/ endpoint accepts a config JSON field that is merged into the crawl configuration without validation and exported as environment variables when archive plugins run. At the time of publication, there are no publicly available patches; users should monitor for updates or apply appropriate mitigations. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42601.

In EGroupware Enterprise Line (EPL) versions before 1.1.20140505, Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta a medium severity vulnerability CVE-2014-2987 was detected. This vulnerability allows remote attackers to hijack the authentication of administrators via multiple cross-site request forgery (CSRF) vectors. This enables attackers to create an administrator user or modify settings, which can be leveraged to execute arbitrary PHP code in conjunction with CVE-2014-2988. To address this issue, users should upgrade to versions 1.1.20140505 (EPL), 1.8.007.20140506 (Community Edition), or 14.1 beta. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2014-2987.

In eGroupware versions before 1.8.004.20120405 a medium severity vulnerability CVE-2012-2211 was detected. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the menuaction parameter to etemplate/process_exec.php. To address this issue, users should upgrade eGroupware to version 1.8.004.20120405. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2012-2211.

In AFFiNE versions up to 0.26.3 a medium severity vulnerability CVE-2026-7702 was detected. This vulnerability allows remote attackers to bypass authorization and access document previews by manipulating the allowDocPreview function within the Public Markdown Preview Endpoint. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7702.

In Mastodon versions prior to 4.5.9, 4.4.16, and 4.3.22 a high severity vulnerability CVE-2026-41259 was detected. This vulnerability allows attackers to bypass email domain restrictions by using specially crafted email addresses with characters interpreted differently by mail servers due to insufficient validation. To address this issue, users should upgrade Mastodon to versions 4.5.9, 4.4.16 or 4.3.22. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-41259.

In Rocket.Chat versions prior to 8.4.0, prior to 8.3.2, prior to 8.2.2, prior to 8.1.3, prior to 8.0.4, prior to 7.13.6, prior to 7.12.7, prior to 7.11.7, and prior to 7.10.10 a medium severity vulnerability CVE-2026-29197 was detected. This vulnerability allows authenticated users without the proper permissions to read Apps-Engine logs due to a typo in the permission checks for the /api/apps/logs and /api/apps/:id/logs endpoints. To address this issue, users should upgrade Rocket.Chat to versions 8.4.0, 8.3.2, 8.2.2, 8.1.3, 8.0.4, 7.13.6, 7.12.7, 7.11.7, 7.10.10 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29197.