In GitLab CE/EE versions 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 a medium severity vulnerability CVE-2026-10733 was detected. This vulnerability allows an authenticated user to cause a Denial of Service (DoS) condition. This occurs due to improper sanitization of user input on the CI/CD Catalog page. To address this issue, users should upgrade GitLab CE/EE to versions 18.10.8, 18.11.5, or 19.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-10733.
Read more Developer Tools
In Ansible Lightspeed all the versions a medium severity vulnerability CVE-2026-44188 was detected. This vulnerability allows a remote attacker to hijack a session and gain unauthorized read access to sensitive Ansible resources, such as inventories, playbooks, and configuration data. This occurs due to insufficient session expiration logic. If an attacker exfiltrates a valid OAuth access token before a user logs out, they can maintain persistent access because the backend application fails to properly invalidate the token upon logout, leaving it active until its natural expiration. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44188.
Read more IT Business Management
In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-47263 was detected. This vulnerability allows an authenticated user (or an anonymous user if login_required is disabled) to access sensitive webhook payloads, leading to information disclosure. This occurs because the MessageBus.publish call for the /web_hook_events/<id> endpoint within Jobs::RedeliverWebHookEvents fails to pass the group_ids parameter. As a result, the communication channel remains readable by unintended users. Since webhook IDs are sequential integers, an attacker can easily enumerate them to access arbitrary event redelivery payloads. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47263.
In Mattermost versions 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.16 a high severity vulnerability CVE-2026-7387 was detected. This vulnerability allows an authenticated user with group-link permissions to escalate their own privileges, as well as the privileges of other group members, to team or channel administrator. This occurs because the application fails to enforce proper role-management authorization checks when setting the scheme_admin flag on group syncable link and patch endpoints. An attacker can exploit this flaw by submitting crafted API requests. To address this issue, users should upgrade Mattermost to a patched version 11.6.2, 11.5.5, and 10.11.17. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7387.
In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53442 was detected. This vulnerability allows an attacker with Item/Extended Read permission, or access to the Jenkins controller file system, to access sensitive information. This occurs because Jenkins fails to encrypt secrets submitted via the POST config.xml API before storing them. As a result, these secrets are saved in plaintext within the job’s config.xml files on the Jenkins controller. To address this issue, users should upgrade Jenkins to a patched version 2.568.0 or later, or LTS 2.555.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53442.
In GitLab EE versions 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 a high severity vulnerability CVE-2026-10087 was detected. This vulnerability allows an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a targeted user, effectively leading to a Cross-Site Scripting (XSS) attack. This occurs due to improper input sanitization within the Analytics Dashboard. To address this issue, users should upgrade GitLab EE to versions 18.10.8, 18.11.5, or 19.0.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-10087.
Read more Developer Tools
In Mattermost versions 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.16 a medium severity vulnerability CVE-2026-6689 was detected. This vulnerability allows an authenticated user with team creation permissions to bypass intended access controls and configure invite-related settings. This occurs due to a missing PermissionInviteUser check when setting AllowOpenInvite or AllowedDomains during the initial team creation process via the POST /api/v4/teams endpoint. While the system properly enforces this check when updating an existing team, this flaw allows a user to create a team that is publicly joinable or restricted to specific domains without having the actual permission to invite users. To address this issue, users should upgrade Mattermost to a patched version 11.6.2, 11.5.5, 10.11.17, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-6689.
In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-44783 was detected. This vulnerability allows authenticated users outside of the allowed groups to post unauthorized messages into a topic’s staff-only whisper channel. This occurs due to a flaw in how replies to whisper posts are handled on sites where the whispers feature is enabled. As a result, the injected content becomes visible to authorized whisperers (typically staff members) alongside legitimate whispers. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44783.
Read more Communication
In LiteLLM versions 1.74.2 to before 1.83.7 a medium severity vulnerability CVE-2026-42271 was detected. This vulnerability allows any authenticated user, including those with low-privileged internal-user keys, to execute arbitrary commands on the proxy host. This occurs because the MCP server preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) improperly accept and execute a full server configuration from the request body. When a stdio configuration containing command, args, and env fields is supplied, the endpoints spawn the specified command as a subprocess with the privileges of the proxy process, completely bypassing role-based access checks. To address this issue, users should upgrade LiteLLM to version 1.83.7. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42271.