Database

In Baserow versions up to 2.3.2 a medium severity vulnerability CVE-2026-18816 was detected. This vulnerability allows a remote attacker to bypass two-factor authentication (2FA) mechanisms, leading to improper authentication and potential unauthorized account access. This occurs due to a flaw in the verify function within the backend/src/baserow/api/two_factor_auth/views.py file of the 2FA Verify Endpoint. Although the attack complexity is considered high and exploitation is difficult, successful manipulation of this endpoint compromises the authentication process. To address this issue, users should upgrade Baserow to version 2.3.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-18816.

In MongoDB versions prior to 7.0.39 a medium severity vulnerability CVE-2026-13066 was detected. This vulnerability allows for the disclosure of internal process memory contents. To address this issue, users should upgrade MongoDB to version 7.0.39 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-13066.

In MongoDB versions prior to 8.0.28 a medium severity vulnerability CVE-2026-13064 was detected. This vulnerability allows attackers to cause resource exhaustion through specially crafted queries. To address this issue, users should upgrade MongoDB to version 8.0.28 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-13064.

In MongoDB versions before 8.2.12 a medium severity vulnerability CVE-2026-13063 was detected. This vulnerability allows an authenticated user to cause a denial of service. To address this issue, users should upgrade MongoDB to version 8.2.12 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-13063.

In Weaviate versions before 1.38.0 a high severity vulnerability CVE-2026-59093 was detected. This vulnerability allows an attacker to escalate their privileges. To address this issue, users should upgrade Weaviate to version 1.38.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-59093.

In PostgreSQL versions before 12.128.12 a high severity vulnerability CVE-2026-56248 was detected. This vulnerability allows unauthenticated attackers to trigger a denial-of-service (statement timeouts / PostgREST error 57014) by issuing unfiltered queries to the public.audit_logs endpoint via the Supabase PostgREST API. To address this issue, users should upgrade capgo-backend 12.128.12 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-56248.

In ChromaDB versions 0.4.17 and later a high severity vulnerability CVE-2026-45833 was detected. This vulnerability allows an authenticated attacker with UPDATE_COLLECTION permissions to execute arbitrary code on the server, leading to Remote Code Execution (RCE). This occurs due to a code injection flaw when the application handles model repositories. By sending a malicious model repository to the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} endpoint and setting the trust_remote_code parameter to true, an attacker can trick the system into executing their malicious payload.There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-45833.

In GeoServer DB2 DataStore Extension versions prior to 2.27.0 a high severity vulnerability CVE-2025-27511 was detected. This vulnerability allows an authenticated administrator to achieve Remote Code Execution (RCE) on the server. This occurs because the extension is vulnerable to a JNDI injection attack when processing a specially crafted DB2 JDBC URL. To address this issue, users should upgrade the GeoServer DB2 DataStore Extension to version 2.27.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27511.

In NocoDB versions prior to 2026.05.1 a medium severity vulnerability CVE-2026-53928 was detected. This vulnerability allows an attacker in possession of a stolen refresh token to maintain unauthorized access by minting new JSON Web Tokens (JWTs), even after the victim has completed a password recovery flow. This occurs because the passwordForgot process fails to delete the user’s active refresh tokens—unlike standard password change or reset flows—leaving them valid for exchange. To address this issue, users should upgrade NocoDB to version 2026.05.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53928.