In OneDev versions up to 15.0.5 a medium severity vulnerability CVE-2026-11440 was detected. This vulnerability allows a remote attacker to bypass intended access controls. This occurs due to improper authorization validation when manipulating the project.defaultBranch argument within the REST API endpoint /repositories/{projectId}/default-branch. To address this issue, users should upgrade OneDev to version 15.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11440.
In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53439 was detected. This vulnerability allows an attacker with Overall/Read permission to access sensitive user configuration data, leading to information disclosure. This occurs due to missing permission checks, which enable the attacker to determine other users’ configured timezones and enumerate the view names of other users’ “My Views”. To address this issue, users should upgrade Jenkins to a patched version 3.1.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53439.
Read more Developer Tools
In Graphite versions before 1.3.15 a high severity vulnerability CVE-2026-50593 was detected. This vulnerability allows an attacker to cause an out-of-bounds memory write, potentially leading to arbitrary code execution, memory corruption, or a denial of service. This occurs due to an integer underflow in the slotat function, which fails to properly validate that an offset is within the allowed slot-map range when processing Graphite actions. To address this issue, users should upgrade Graphite to version 1.3.15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50593.
In Prefect version 3.6.19 a high severity vulnerability CVE-2026-3514 was detected. This vulnerability allows an unauthenticated attacker to bypass authentication and gain unauthorized access to sensitive information, such as API keys and database credentials. This occurs due to the improper handling of URL path exemptions for health check probes. The authentication middleware incorrectly exempts any URL path ending with ‘health’ or ‘ready’ from authentication checks. An attacker can exploit this by creating resources (such as variables, flows, work pools, work queues, and deployments) with names ending in ‘health’ or ‘ready’ to access them without authentication. To address this issue, users should upgrade Prefect to version 3.6.22 or higher. For more details, visit https://avd.aquasec.com/nvd/2026/cve-2026-3514.
Read more Developer Tools
In OneDev versions up to 15.0.5 a medium severity vulnerability CVE-2026-11439 was detected. This vulnerability allows a remote attacker to bypass intended access controls. This occurs due to improper authorization validation when manipulating the project.parentId argument within the Parent Project Handler for the /projects/ functionality. To address this issue, users should upgrade OneDev to version 15.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11439.
In LimeSurvey all versions a high severity vulnerability CVE-2026-50635 was detected. This vulnerability allows a remote, unauthenticated attacker to take over a user’s account. This occurs due to a Host Header Injection flaw where LimeSurvey constructs account password-reset links using the unvalidated, client-supplied HTTP Host header (because the allowedHosts allowlist is undefined in the default configuration). By submitting a forgotten-password request with a spoofed Host header, the attacker causes the system to email a reset link pointing to an attacker-controlled server but containing a genuine validation_key. When the victim or an automated email scanner dereferences the link, the token is disclosed to the attacker, who can then use it on the legitimate site to set a new password. To address this issue, users should upgrade LimeSurvey to version version 7.x or the latest 6.x patch release and ensure the allowedHosts parameter is properly configured. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50635.
In Django versions 5.2 before 5.2.15 and 6.0 before 6.0.6 a low severity vulnerability CVE-2026-35193 was detected. This vulnerability allows remote attackers to read private, authenticated cached responses, leading to sensitive information disclosure. This occurs because the django.middleware.cache.UpdateCacheMiddleware fails to add the Authorization field to the Vary response header for requests bearing that header (unless Cache-Control: public is set). As a result, an unauthenticated request to the same URL can inadvertently be served a cached response meant for a specific authenticated user. To address this issue, users should upgrade Django to versions 5.2.15 or 6.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-35193.
In Weaviate versions up to 1.37.7 a medium severity vulnerability CVE-2026-11500 was detected. This vulnerability allows a remote attacker to bypass intended access controls and gain unauthorized access. This occurs due to improper validation of the StaticApiKey argument within the validateConfig function of the Static API Key Handler (internal/usecases/auth/authentication/apikey/client.go). Although the attack complexity is high and exploitability is considered difficult, a public exploit is available. To address this issue, users should apply the patch (commit 40f2cc32279f0f8a51016c3c6870a2c0c808e6c0) or upgrade Weaviate to version 1.38.0-rc.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11500.
Read more Database
In OpenVPN versions 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 a medium severity vulnerability CVE-2026-35058 was detected. This vulnerability allows an authenticated attacker to cause a Denial of Service (DoS) by crashing the application. This occurs due to improper validation of packet length during the tls-crypt-v2 key extraction process. By sending a specially crafted packet, an attacker can trigger a fatal assertion, which leads to the termination of the service. To address this issue, users should upgrade OpenVPN to a patched version 2.6.20 and 2.7.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-35058.
Read more CMS