Data Management and Analytics

In fluent-plugin-opentelemetry component for Fluentd versions prior to 0.5.3 a medium severity vulnerability CVE-2026-44163 was detected. This vulnerability allows attackers to cause resource exhaustion by sending a large, compressed payload. To address this issue, users should upgrade fluent-plugin-opentelemetry to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44163.

In PostGIS component for PostgreSQL versions 3.7.0 and earlier a medium severity vulnerability CVE-2026-90775 was detected. This vulnerability allows attackers to cause the backend process to crash, leading to a denial of service. To address this issue, users should upgrade PostGIS to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-90775.

In PostgreSQL Anonymizer component for PostgreSQL versions earlier than 3.1.4 a high severity vulnerability CVE-2026-19633 was detected. This vulnerability allows unprivileged masked users to execute arbitrary code with elevated privileges. To address this issue, users should upgrade PostgreSQL Anonymizer to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19633.

In Apache Hive versions before 4.2.1 a critical severity vulnerability CVE-2026-49845 was detected. This vulnerability allows authenticated users to read, modify, or affect unintended partition metadata. To address this issue, users should upgrade Apache Hive to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-49845.

In Apache Hive versions 4.0.0 through 4.2.0 a high severity vulnerability CVE-2026-53561 was detected. This vulnerability allows an unauthenticated attacker to authenticate as an arbitrary user. To address this issue, users should upgrade Apache Hive to version 4.2.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53561.

In Apache Hive versions before 4.2.1 a critical severity vulnerability CVE-2026-55976 was detected. This vulnerability allows an authenticated remote attacker to perform Server-Side Request Forgery (SSRF) attacks. To address this issue, users should upgrade Apache Hive to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-55976.

In Grafana versions prior to 12.4.0 a medium severity vulnerability CVE-2026-17033 was detected. This vulnerability allows an authenticated attacker to submit a malicious alert containing a controlled URL. To address this issue, users should upgrade Grafana to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-17033.

In Baserow version 2.3.3 a high severity vulnerability CVE-2026-19754 was detected. This vulnerability allows a low-privileged authenticated user to execute arbitrary database queries, leading to SQL Injection (SQLi) and potential privilege escalation. This occurs due to improper input validation in the index() formula function. A user with permissions to create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. When Baserow recalculates the formula field values, the injected payload is executed. Because the generated SQL runs through the application’s database connection, it executes with the full privileges of the Baserow PostgreSQL role rather than the restricted permissions of the authenticated user. To address this issue, users should upgrade Baserow to a patched version 2.3.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19754.

In Elasticsearch versions from 8.18.0 before 8.19.20, and from 9.0.0 before 9.4.5 a medium severity vulnerability CVE-2026-78605 was detected. This vulnerability allows a network attacker to obtain confidential HTTP responses intended for other authenticated users, leading to unauthorized information disclosure. This occurs due to an Inconsistent Interpretation of HTTP Requests, commonly known as HTTP Request Smuggling (CWE-444). Under specific proxy deployment configurations, an attacker can manipulate HTTP requests to desynchronize the connection between the frontend proxy and the backend Elasticsearch server, allowing them to intercept or view responses belonging to other users’ sessions (CAPEC-33). To address this issue, users should upgrade Elasticsearch to versions 8.19.20, 9.4.5, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-78605.