Data Management and Analytics

In pgAdmin 4 versions prior to 9.15. a high severity vulnerability CVE-2026-7815 was detected. This vulnerability allows an authenticated user with tools_maintenance permissions to execute arbitrary SQL on the connected PostgreSQL server, which can be escalated to operating-system command execution on the database host. This occurs because four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) are concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command without proper sanitization and passed to psql. To address this issue, users should upgrade pgAdmin 4 to version 9.15 or above. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7815.

In vLLM version 0.19.0 a medium severity vulnerability CVE-2026-9540 was detected. This vulnerability allows a remote attacker to cause a Denial of Service (DoS). This occurs due to a flaw in the OpenAI-compatible Serving Path component when processing certain manipulated data. An exploit for this issue is publicly available. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-9540.

In Prometheus versions 2.49.0 to before 3.5.3 and 3.11.3 a low severity vulnerability CVE-2026-44903 was detected. This vulnerability allows an attacker who can inject crafted metrics to execute arbitrary JavaScript (XSS) in the browser of any user viewing the metric. This occurs in the legacy web UI (enabled via the –enable-feature=old-ui flag) because the histogram heatmap chart view fails to properly escape ‘le’ label values when inserting them into the HTML for use as axis tick mark labels. To address this issue, users should upgrade Prometheus to versions 3.5.3 or 3.11.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44903.

In JupyterLab versions 4.0.0 through 4.5.6 a high severity vulnerability CVE-2026-42266 was detected. This vulnerability allows an attacker to install malicious third-party extensions via a POST request. This occurs because the allow-list for the PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced, allowing packages outside the default PyPI index to be installed. To address this issue, users should upgrade JupyterLab to version 4.5.7. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42266.

In pgAdmin 4 versions before 9.15 a medium severity vulnerability CVE-2026-7814 was detected. This vulnerability allows an attacker to execute Stored Cross-Site Scripting (XSS) attacks. This occurs because user-controlled PostgreSQL object names are unsafely assigned to DOM elements via innerHTML in the Browser Tree and Explain Visualizer modules, allowing attacker-supplied JavaScript to execute when a user navigates to or executes EXPLAIN over the malicious object. To address this issue, users should upgrade pgAdmin 4 to version 9.15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7814.

In MLflow versions 3.9.0 and earlier a high severity vulnerability CVE-2026-2652 was detected. This vulnerability allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. This occurs due to an architectural mismatch between Flask and FastAPI authentication mechanisms, where the FastAPI permission middleware fails to enforce authentication on non-/gateway/ routes (such as the Job API and OpenTelemetry trace ingestion API) when the server is started with basic authentication enabled and served via uvicorn. To address this issue, users should upgrade MLflow to version 3.10.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-2652.

In MongoDB Server versions v8.2 prior to 8.2.9 and v8.3 prior to 8.3.2 a high severity vulnerability CVE-2026-8336 was detected. This vulnerability allows an authenticated user to cause a post-authentication Denial of Service (DoS) by crashing the mongod process. This occurs due to a use-after-free error when the $_internalJsEmit function (which is not intended to be directly accessible) or the mapreduce command’s map function is invoked in a specific way, followed by subsequent use of the server-side JavaScript engine (e.g., through $where, $function, or mapreduce reduce stage). To address this issue, users should upgrade MongoDB Server to versions 8.2.9 or 8.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-8336.

In MongoDB Server versions v7.0 prior to 7.0.34, v8.0 prior to 8.0.23, v8.2 prior to 8.2.9, and v8.3 prior to 8.3.2 a medium severity vulnerability CVE-2026-8202 was detected. This vulnerability allows an authenticated user with aggregation permissions to cause a Denial of Service (DoS) by pinning CPU utilization at 100% for an extended period. This occurs when a densely populated chars mask and a large input string are used in the MongoDB aggregation operators $trim, $ltrim, and $rtrim. To address this issue, users should upgrade MongoDB Server to versions 7.0.34, 8.0.23, 8.2.9, or 8.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-8202.

In CKAN versions prior to 2.10.10 and 2.11.5 a medium severity vulnerability CVE-2026-41255 was detected. This vulnerability allows an attacker to bypass Cross-Site Request Forgery (CSRF) protections. This occurs because accessing views via tokens or unauthenticated requests globally marks the endpoint as not requiring CSRF protection for the lifetime of the server process (e.g., a single worker of uWSGI), exposing subsequent authenticated requests to CSRF attacks. To address this issue, users should upgrade CKAN to versions 2.10.10 or 2.11.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-41255.