Data Management and Analytics

In SQLite in affected versions a medium severity vulnerability CVE-2025-41771 was detected. This vulnerability allows an authenticated attacker to perform a SQL injection. To address this issue, users should upgrade SQLite to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-41771.

In Apache Airflow versions before 22.3.0 a medium severity vulnerability CVE-2026-68868 was detected. This vulnerability allows an attacker to resolve another team’s Connection or Variable, obtaining its credentials in full. To address this issue, users should upgrade Apache Airflow to version 22.3.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-68868.

In Kibana versions up to 8.16.2.a medium severity vulnerability CVE-2026-78581 was detected. This vulnerability allows an authenticated attacker to access or modify AI Assistant conversations they do not own, leading to unauthorized data modification and potential information disclosure. This occurs due to an Authorization Bypass Through User-Controlled Key (CWE-639) flaw. By referencing another user’s AI Assistant conversation identifier, an attacker can bypass Access Control Lists (ACLs) and interact with that conversation (CAPEC-1). However, successful exploitation requires the attacker to obtain or guess this specific, hard-to-guess identifier. To address this issue, users should upgrade Kibana to a patched version Elastic Kibana versions 8.16.3 and 8.17.2.. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-78581.

In the Triton MLflow plugin component for MLflow in earlier versions a medium severity vulnerability CVE-2026-47487 was detected. This vulnerability allows an attacker to read, write, or modify files outside the intended model repository. To address this issue, users should upgrade MLflow to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47487.

In Apache NiFi versions 1.10.0 through 2.10.0 a medium severity vulnerability CVE-2026-62354 was detected. This vulnerability allows users with read access to override configuration settings. To address this issue, users should upgrade Apache NiFi to version 2.11.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-62354.

In Apache NiFi versions 2.0.0 through 2.10.0 a critical severity vulnerability CVE-2026-68980 was detected. This vulnerability allows unauthorized asset deletion via the REST API. To address this issue, users should upgrade Apache NiFi to version 2.11.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-68980.

In Apache NiFi versions 1.5.0 through 2.10.0 a high severity vulnerability CVE-2026-68981 was detected. This vulnerability allows attackers to consume excessive amounts of memory through crafted requests. To address this issue, users should upgrade Apache NiFi to version 2.11.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-68981.

In Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 a high severity vulnerability CVE-2026-72730 was detected. This vulnerability allows an attacker to execute malicious scripts in the context of a victim’s browser, leading to Stored Cross-Site Scripting (XSS). This occurs because the Rich Text Editor improperly renders chat-transcript usernames as raw HTML without adequate escaping or sanitization. By crafting a username that includes malicious HTML or JavaScript payloads, an attacker can persistently inject code that gets executed whenever other users view the affected chat transcript. To address this issue, users should upgrade Discourse to versions 2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-72730.

In Baserow versions up to 2.3.2 a medium severity vulnerability CVE-2026-18816 was detected. This vulnerability allows a remote attacker to bypass two-factor authentication (2FA) mechanisms, leading to improper authentication and potential unauthorized account access. This occurs due to a flaw in the verify function within the backend/src/baserow/api/two_factor_auth/views.py file of the 2FA Verify Endpoint. Although the attack complexity is considered high and exploitation is difficult, successful manipulation of this endpoint compromises the authentication process. To address this issue, users should upgrade Baserow to version 2.3.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-18816.