Data Management and Analytics

In the Triton MLflow plugin component for MLflow in earlier versions a medium severity vulnerability CVE-2026-47487 was detected. This vulnerability allows an attacker to read, write, or modify files outside the intended model repository. To address this issue, users should upgrade MLflow to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47487.

In Apache NiFi versions 1.10.0 through 2.10.0 a medium severity vulnerability CVE-2026-62354 was detected. This vulnerability allows users with read access to override configuration settings. To address this issue, users should upgrade Apache NiFi to version 2.11.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-62354.

In Apache NiFi versions 2.0.0 through 2.10.0 a critical severity vulnerability CVE-2026-68980 was detected. This vulnerability allows unauthorized asset deletion via the REST API. To address this issue, users should upgrade Apache NiFi to version 2.11.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-68980.

In Apache NiFi versions 1.5.0 through 2.10.0 a high severity vulnerability CVE-2026-68981 was detected. This vulnerability allows attackers to consume excessive amounts of memory through crafted requests. To address this issue, users should upgrade Apache NiFi to version 2.11.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-68981.

In Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 a high severity vulnerability CVE-2026-72730 was detected. This vulnerability allows an attacker to execute malicious scripts in the context of a victim’s browser, leading to Stored Cross-Site Scripting (XSS). This occurs because the Rich Text Editor improperly renders chat-transcript usernames as raw HTML without adequate escaping or sanitization. By crafting a username that includes malicious HTML or JavaScript payloads, an attacker can persistently inject code that gets executed whenever other users view the affected chat transcript. To address this issue, users should upgrade Discourse to versions 2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-72730.

In Baserow versions up to 2.3.2 a medium severity vulnerability CVE-2026-18816 was detected. This vulnerability allows a remote attacker to bypass two-factor authentication (2FA) mechanisms, leading to improper authentication and potential unauthorized account access. This occurs due to a flaw in the verify function within the backend/src/baserow/api/two_factor_auth/views.py file of the 2FA Verify Endpoint. Although the attack complexity is considered high and exploitation is difficult, successful manipulation of this endpoint compromises the authentication process. To address this issue, users should upgrade Baserow to version 2.3.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-18816.

In MongoDB versions prior to 7.0.39 a medium severity vulnerability CVE-2026-13066 was detected. This vulnerability allows for the disclosure of internal process memory contents. To address this issue, users should upgrade MongoDB to version 7.0.39 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-13066.

In MongoDB versions prior to 8.0.28 a medium severity vulnerability CVE-2026-13064 was detected. This vulnerability allows attackers to cause resource exhaustion through specially crafted queries. To address this issue, users should upgrade MongoDB to version 8.0.28 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-13064.

In MongoDB versions before 8.2.12 a medium severity vulnerability CVE-2026-13063 was detected. This vulnerability allows an authenticated user to cause a denial of service. To address this issue, users should upgrade MongoDB to version 8.2.12 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-13063.