Data Management and Analytics

In Supabase Capgo versions before 12.128.2 a high severity vulnerability CVE-2026-56245 was detected. This vulnerability allows unauthenticated attackers to insert arbitrary build-time records to poison billing and quota data for any organization. To address this issue, users should upgrade Supabase Capgo to version 12.128.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56245.

In Supabase versions before 12.128.2 a medium severity vulnerability CVE-2026-56234 was detected. This vulnerability allows attackers to call the POST /functions/v1/private/validate_password_compliance endpoint using only the public Supabase key, leveraging CORS wildcard origin allowance and lack of rate limiting to perform password spraying and credential stuffing to compromise user accounts. To address this issue, users should upgrade Capgo to version 12.128.2 or later.. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56234.

In PostgreSQL versions before 12.128.12 a high severity vulnerability CVE-2026-56248 was detected. This vulnerability allows unauthenticated attackers to trigger a denial-of-service (statement timeouts / PostgREST error 57014) by issuing unfiltered queries to the public.audit_logs endpoint via the Supabase PostgREST API. To address this issue, users should upgrade capgo-backend 12.128.12 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56248.

In Elasticsearch versions including 7.0.0 and before 7.17.24, including 8.0.0 and before 8.15.0 a medium severity vulnerability CVE-2026-49090 was detected. This vulnerability allows an authenticated user to cause a Denial of Service (DoS) by rendering the affected node unable to process requests. This occurs due to an Uncontrolled Resource Consumption (CWE-400) flaw when processing bulk requests. By submitting a specially crafted bulk request, an attacker can trigger sustained high CPU consumption via excessive resource allocation (CAPEC-130), effectively exhausting server resources. To address this issue, users should upgrade Elasticsearch to a patched version 7.17.24 or later, 8.15.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-49090.

In Elasticsearch versions up to 8.19.16/9.3.5/9.4.2 a medium severity vulnerability CVE-2026-56149 was detected. This vulnerability allows an authenticated user with elevated privileges to cause a Denial of Service (DoS) by rendering the affected node unavailable. This occurs due to an Allocation of Resources Without Limits or Throttling (CWE-770) flaw in the processing of machine learning requests. By submitting a specially crafted machine learning request, an attacker can trigger excessive memory allocation (CAPEC-130), leading to resource exhaustion and the subsequent unavailability of the Elasticsearch node. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56149.

In Docling versions 2.45.0 to before 2.91.0 a medium severity vulnerability CVE-2026-44018 was detected. This vulnerability allows an attacker to read sensitive files, exhaust system resources, or cause application crashes, leading to unauthorized information disclosure and Denial of Service (DoS). This occurs due to unsafe archive extraction and a lack of security controls during XML parsing in the METS-GBS backend. By crafting a malicious METS-GBS archive and exploiting the input document format detection mechanisms (such as via XML External Entity (XXE) injection or archive bombs), an attacker can compromise the parsing process. To address this issue, users should upgrade Docling to version 2.91.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44018.

In ChromaDB versions 0.4.17 and later a high severity vulnerability CVE-2026-45833 was detected. This vulnerability allows an authenticated attacker with UPDATE_COLLECTION permissions to execute arbitrary code on the server, leading to Remote Code Execution (RCE). This occurs due to a code injection flaw when the application handles model repositories. By sending a malicious model repository to the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} endpoint and setting the trust_remote_code parameter to true, an attacker can trick the system into executing their malicious payload.There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-45833.

In Docling versions prior to 2.91.0 a high severity vulnerability CVE-2026-44017 was detected. This vulnerability allows an attacker to write arbitrary files to any location writable by the process, potentially leading to Remote Code Execution (RCE) or persistent backdoors. This occurs due to a Zip Slip flaw in the EasyOCR model download functionality, where ZIP archives are extracted without properly validating member paths. If an attacker successfully compromises the model download source—such as through a supply chain attack, DNS spoofing, or a Man-in-the-Middle (MITM) attack—they can deliver a maliciously crafted ZIP file containing directory traversal sequences. To address this issue, users should upgrade Docling to version 2.91.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44017.

In Docling versions 2.73.0 to before 2.91.0 a medium severity vulnerability CVE-2026-44022 was detected. This vulnerability allows an attacker to read arbitrary files from the local file system, potentially exposing configuration files, credentials, and other sensitive data. This occurs due to a path traversal flaw in the LaTeX backend’s handling of the \includegraphics, \input, and \include commands, which lacked proper path containment validation. By crafting a malicious LaTeX document with directory traversal sequences, an attacker can force the system to include sensitive files directly into the converted document output. To address this issue, users should upgrade Docling to version 2.91.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44022.