Our news and updates

In MinIO versions RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z a medium severity vulnerability CVE-2026-42600 was detected. This vulnerability allows an attacker holding the cluster root JWT to read arbitrary files from outside the configured drive roots via a path traversal attack. This occurs because the ReadMultiple internode storage-REST endpoint improperly processes a msgpack-encoded POST request containing “../” sequences in the Bucket field, causing the server to open and return the contents of unintended files (bounded only by the MinIO process UID). To address this issue, users should upgrade MinIO to version RELEASE.2026-04-14T21-32-45Z. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42600.

In Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14 a medium severity vulnerability CVE-2026-3636 was detected. This vulnerability allows a user without elevated permissions to obtain sensitive data regarding team members’ roles. This occurs because the application fails to properly sanitize team member data when it is returned via various team API endpoints. To address this issue, users should upgrade Mattermost to version Version 11.7.0 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3636.

In JupyterLab versions 4.0.0 through 4.5.6 a high severity vulnerability CVE-2026-42266 was detected. This vulnerability allows an attacker to install malicious third-party extensions via a POST request. This occurs because the allow-list for the PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced, allowing packages outside the default PyPI index to be installed. To address this issue, users should upgrade JupyterLab to version 4.5.7. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42266.

In Joomla! Core versions 4.1.0 through 5.4.5 a medium severity vulnerability CVE-2026-48900 was detected. This vulnerability allows low-privileged users to edit the task types of existing scheduler tasks due to an improper access control check in the com_scheduler component. To address this issue, users should upgrade Joomla! Core to version 5.4.6 (or later). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48900.

In pgAdmin 4 versions before 9.15 a medium severity vulnerability CVE-2026-7814 was detected. This vulnerability allows an attacker to execute Stored Cross-Site Scripting (XSS) attacks. This occurs because user-controlled PostgreSQL object names are unsafely assigned to DOM elements via innerHTML in the Browser Tree and Explain Visualizer modules, allowing attacker-supplied JavaScript to execute when a user navigates to or executes EXPLAIN over the malicious object. To address this issue, users should upgrade pgAdmin 4 to version 9.15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7814.

In Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier a low severity vulnerability CVE-2026-34685 was detected. This vulnerability allows a high-privileged attacker to bypass security measures and gain unauthorized write access (potentially leading to arbitrary file system writes). This occurs due to improper input validation. Exploitation of this issue requires user interaction, meaning a victim must visit a maliciously crafted URL or interact with a compromised web page. To address this issue, users should upgrade Adobe Commerce to version 2.4.9 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-34685.

In Plane versions 1.3.0 and below a medium severity vulnerability CVE-2026-40102 was detected. This vulnerability allows an authenticated workspace member to extract sensitive data, including bcrypt password hashes, API tokens, and user email addresses. This occurs due to an Object-Relational Mapping (ORM) Field Reference Injection flaw in the SavedAnalyticEndpoint, where the user-controlled “segment” query parameter is passed directly to a Django F() expression without validation. By crafting a specific segment value, an attacker can traverse foreign-key relationships (e.g., workspace__owner__password) and have the referenced field values returned directly in the JSON response. To address this issue, users should upgrade Plane to version 1.3.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-40102.

In authentik versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2 a high severity vulnerability CVE-2026-40166 was detected. This vulnerability allows authenticated non-admin users to retrieve the confidential OAuth client_secret of providers they have previously authenticated against. This occurs because the GET /api/v3/oauth2/access_tokens/ endpoint improperly includes a nested provider object containing the client_id and client_secret in its response, exposing sensitive information to low-privilege users. To address this issue, users should upgrade authentik to versions 2025.12.5 or 2026.2.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-40166.

In MongoDB Server versions v8.2 prior to 8.2.9 and v8.3 prior to 8.3.2 a high severity vulnerability CVE-2026-8336 was detected. This vulnerability allows an authenticated user to cause a post-authentication Denial of Service (DoS) by crashing the mongod process. This occurs due to a use-after-free error when the $_internalJsEmit function (which is not intended to be directly accessible) or the mapreduce command’s map function is invoked in a specific way, followed by subsequent use of the server-side JavaScript engine (e.g., through $where, $function, or mapreduce reduce stage). To address this issue, users should upgrade MongoDB Server to versions 8.2.9 or 8.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-8336.