Our news and updates

In Budibase versions prior to 3.35.4 critical severity vulnerability CVE-2026-41428 was detected. This vulnerability allows attackers to bypass authentication and gain unauthenticated access to protected endpoints by exploiting unanchored regular expressions in the public endpoint matcher via query parameters. To address this issue users must upgrade to 3.35.4 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-41428.

In Apache Airflow versions prior to 3.2.1 medium severity vulnerability CVE-2026-40690 was detected. This vulnerability allows attackers to bypass DAG-level access control via the asset graph view, enabling unauthorized users to view unrelated topologies, asset names, and the existence of DAGs outside their authorized scope. To address this issue users must upgrade to 3.2.1 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-40690.

In GitLab CE/EE versions from 18.11 before 18.11.1 low severity vulnerability CVE-2026-3254 was detected. This vulnerability allows attackers to load unauthorized content into another user’s browser due to improper input validation in the Mermaid sandbox. To address this issue users must upgrade to 18.11.1 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3254.

In Apache Airflow versions prior to 3.2.1 medium severity vulnerability CVE-2026-38743 was detected. This vulnerability allows attackers to retrieve Human-in-the-Loop (HITL) prompts and TaskInstance details for DAGs outside their authorized scope by exploiting a lack of per-DAG access control on the authenticated /ui/dags endpoint. To address this issue users must upgrade to 3.2.1 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-38743.

In GitLab CE/EE versions 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 medium severity vulnerability CVE-2026-1660 was detected. This vulnerability allows attackers to cause a denial of service when importing issues due to improper input validation and the allocation of resources without limits or throttling. To address this issue users must upgrade to 18.9.6, 18.10.4, or 18.11.1 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1660.

In GitLab CE/EE versions 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 a high severity vulnerability CVE-2026-6515 was detected. This vulnerability allows attackers to use invalidated or incorrectly scoped credentials to access Virtual Registries under certain conditions. To address this issue users must upgrade to 18.9.6, 18.10.4, or 18.11.1 versions. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-6515.

In Mattermost Server versions 10.11.x before 10.11.13, 11.3.x before 11.3.3, 11.4.x before 11.4.3, and 11.5.0 high severity vulnerability CVE-2026-28741 was detected. This vulnerability allows attackers to update a user’s authentication method via a CSRF attack by tricking a user into visiting a malicious page. To address this issue users must upgrade to 10.11.13, 11.3.3, 11.4.3, or 11.5.1 versions. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-28741.

In GitLab CE/EE versions 18.11 before 18.11.1 medium severity vulnerability CVE-2026-5377 was detected. This vulnerability allows attackers to access titles of confidential or private issues in public projects due to improper access control in the issue description rendering process. To address this issue users must upgrade to 18.11.1 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-5377.

In GitLab CE/EE versions 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 high severity vulnerability CVE-2026-5262 was detected. This vulnerability allows attackers to access tokens in the Storybook development environment due to improper input validation. To address this issue users must upgrade to 18.9.6, 18.10.4, or 18.11.1 versions. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-5262.