Communication and Collaboration

In Rocket.Chat versions prior to 8.3.0, prior to 8.2.1, prior to 8.1.2, prior to 8.0.3, prior to 7.13.5, prior to 7.12.6, prior to 7.11.6, and prior to 7.10.9 a critical severity vulnerability CVE-2026-29198 was detected. This vulnerability allows attackers to perform NoSQL injection in the OAuth flow, potentially leading to account takeover of the first user with a generated token when an OAuth application is configured. To address this issue, users should upgrade Rocket.Chat to versions 8.3.0, 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6 or 7.10.9. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29198.

In Mattermost Server versions 10.11.x before 10.11.13, 11.3.x before 11.3.3, 11.4.x before 11.4.3, and 11.5.0 high severity vulnerability CVE-2026-28741 was detected. This vulnerability allows attackers to update a user’s authentication method via a CSRF attack by tricking a user into visiting a malicious page. To address this issue users must upgrade to 10.11.13, 11.3.3, 11.4.3, or 11.5.1 versions. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-28741.

In Mattermost versions 10.11.x through 10.11.12 a medium severity vulnerability CVE-2026-27769 was detected. This vulnerability allows a malicious remote server connected via the Connected Workspaces feature to change the displayed status of local users by exploiting a failure to validate user ownership within the Connected Workspaces API. To address this issue, users must upgrade to version 11.5.0 or 10.11.13. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27769.

In Zulip versions 1.4.0 to before 11.6 high severity vulnerability CVE-2026-25742 was detected. This vulnerability allows attackers to retrieve attachments originating from web-public streams and access topic history via the /users/me/<stream_id>/topics endpoint anonymously, even after spectator access has been disabled. To address this issue users must upgrade to 11.6 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25742.

In Mattermost Plugins versions <=2.3.1 high severity vulnerability CVE-2026-21388 was detected. This vulnerability allows authenticated attackers to cause memory exhaustion and denial of service via sending an oversized JSON payload to the /lifecycle webhook endpoint. To address this issue users must upgrade to 2.3.2.0 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-21388.

In Mattermost Plugin Legal Hold versions <=1.4.1 high severity vulnerability CVE-2026-3524 was detected. This vulnerability allows authenticated attackers to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints due to a failure to halt request processing after a failed authorization check. To address this issue users must upgrade to 1.1.5.0 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3524.

In Mattermost Plugins versions <=2.1.3.0 medium severity vulnerability CVE-2026-24661 was detected. This vulnerability allows attackers to cause memory exhaustion and denial of service by sending an oversized JSON payload to the {{/changes}} webhook endpoint. To address this issue users must upgrade to the 2.3.2.0 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24661.

In Discourse versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0 a low severity vulnerability CVE-2026-34947 was detected. This vulnerability allows attackers to access staged user custom fields and usernames on public invite pages without email verification, leading to unintended information disclosure. To address this issue, users should upgrade Discourse to versions 2026.1.3, 2026.2.2 , or 2026.3.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-34947.

In Discourse versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0 a medium severity vulnerability CVE-2026-27481 was detected. This vulnerability allows unauthenticated or unauthorized users to view hidden staff-only tags and associated data due to an authorization bypass in tag routes. To address this issue, users should upgrade Discourse to versions 2026.1.3, 2026.2.2, or 2026.3.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27481.