Communication and Collaboration

In AFFiNE versions up to 0.26.3 a medium severity vulnerability CVE-2026-7702 was detected. This vulnerability allows remote attackers to bypass authorization and access document previews by manipulating the allowDocPreview function within the Public Markdown Preview Endpoint. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7702.

In Mastodon versions prior to 4.5.9, 4.4.16, and 4.3.22 a high severity vulnerability CVE-2026-41259 was detected. This vulnerability allows attackers to bypass email domain restrictions by using specially crafted email addresses with characters interpreted differently by mail servers due to insufficient validation. To address this issue, users should upgrade Mastodon to versions 4.5.9, 4.4.16 or 4.3.22. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-41259.

In Rocket.Chat versions prior to 8.4.0, prior to 8.3.2, prior to 8.2.2, prior to 8.1.3, prior to 8.0.4, prior to 7.13.6, prior to 7.12.7, prior to 7.11.7, and prior to 7.10.10 a medium severity vulnerability CVE-2026-29197 was detected. This vulnerability allows authenticated users without the proper permissions to read Apps-Engine logs due to a typo in the permission checks for the /api/apps/logs and /api/apps/:id/logs endpoints. To address this issue, users should upgrade Rocket.Chat to versions 8.4.0, 8.3.2, 8.2.2, 8.1.3, 8.0.4, 7.13.6, 7.12.7, 7.11.7, 7.10.10 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29197.

In Rocket.Chat versions prior to 8.3.0, prior to 8.2.1, prior to 8.1.2, prior to 8.0.3, prior to 7.13.5, prior to 7.12.6, prior to 7.11.6, and prior to 7.10.9 a critical severity vulnerability CVE-2026-29198 was detected. This vulnerability allows attackers to perform NoSQL injection in the OAuth flow, potentially leading to account takeover of the first user with a generated token when an OAuth application is configured. To address this issue, users should upgrade Rocket.Chat to versions 8.3.0, 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6 or 7.10.9. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29198.

In Mattermost Server versions 10.11.x before 10.11.13, 11.3.x before 11.3.3, 11.4.x before 11.4.3, and 11.5.0 high severity vulnerability CVE-2026-28741 was detected. This vulnerability allows attackers to update a user’s authentication method via a CSRF attack by tricking a user into visiting a malicious page. To address this issue users must upgrade to 10.11.13, 11.3.3, 11.4.3, or 11.5.1 versions. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-28741.

In Mattermost versions 10.11.x through 10.11.12 a medium severity vulnerability CVE-2026-27769 was detected. This vulnerability allows a malicious remote server connected via the Connected Workspaces feature to change the displayed status of local users by exploiting a failure to validate user ownership within the Connected Workspaces API. To address this issue, users must upgrade to version 11.5.0 or 10.11.13. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27769.

In Zulip versions 1.4.0 to before 11.6 high severity vulnerability CVE-2026-25742 was detected. This vulnerability allows attackers to retrieve attachments originating from web-public streams and access topic history via the /users/me/<stream_id>/topics endpoint anonymously, even after spectator access has been disabled. To address this issue users must upgrade to 11.6 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25742.

In Mattermost Plugins versions <=2.3.1 high severity vulnerability CVE-2026-21388 was detected. This vulnerability allows authenticated attackers to cause memory exhaustion and denial of service via sending an oversized JSON payload to the /lifecycle webhook endpoint. To address this issue users must upgrade to 2.3.2.0 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-21388.

In Mattermost Plugin Legal Hold versions <=1.4.1 high severity vulnerability CVE-2026-3524 was detected. This vulnerability allows authenticated attackers to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints due to a failure to halt request processing after a failed authorization check. To address this issue users must upgrade to 1.1.5.0 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3524.